Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-02 | 1 | Disclosure1 |
| 2026-02-03 | 1 | General1 |
| 2026-02-06 | 1 | Disclosure1 |
CVE-2025-69207 - This one was kind of funny. IDOR on Notion oauth flow could allow me to link my notion to any other account and subsequently poison agent indexes.
Post summary
The text discloses that CVE-2025-69207 is an IDOR vulnerability in Notion’s OAuth flow, enabling an attacker to link an account to another and poison agent indexes.
CVE-2025-69207 Notion OAuth IDOR Vulnerability in Khoj AI App Before 2.0.0-beta.23 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-69207
Post summary
A Notion OAuth IDOR vulnerability (CVE-2025-69207) affecting Khoj AI App versions before 2.0.0-beta.23 was disclosed, but the text provides no PoC, exploit, active exploitation, or patch details.
CVE-2025-69207 Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integ… https://www.cve.org/CVERecord?id=CVE-2025-69207
Post summary
CVE-2025-69207 describes an IDOR flaw in Khoj's Notion OAuth callback (pre‑2.0.0-beta.23) that could allow hijacking of Notion integrations, but no PoC, exploit, patch, or active exploitation is reported.
16 of 16 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | khoj | khoj | - | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |
| App | khoj | khoj | 2.0.0 | - | - |