Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Multiple vulnerabilities in 1millionbot Millie chatbot

Posted date 31/03/2026
Identificador
INCIBE-2026-243
Importance
4 - High
Affected Resources

Millie chat, versions prior to 3.6.0.

Description

INCIBE has coordinated the publication of 2 high severity vulnerabilities, affecting Millie chatbot by 1millionbot, a chatbot and AI platform. The vulnerabilities were discovered by David Utón Amaya (m3n0sd0n4ld).

These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:

  • CVE-2026-4399: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE- 1427
  • CVE-2026-4400: CVSS v4.0: 7.0 | CVSS AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N | CWE- 639
Solution

The vulnerabilities have been fixed by 1millionbot team in version 3.6.0.

Detail
  • CVE-2026-4399: Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions using Boolean prompt injection techniques (formulating a question in such a way that, upon receiving an affirmative response ('true'), the model executes the injected instruction), causing it to return prohibited information and information outside its intended context. Successful exploitation of this vulnerability could allow a malicious remote attacker to abuse the service for purposes other than those originally intended, or even execute out-of-context tasks using 1millionbot's resources and/or OpenAI's API key. This allows the attacker to evade the containment mechanisms implemented during LLM model training and obtain responses or chat behaviors that were originally restricted.
  • CVE-2026-4400: Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changing the conversation ID. The vulnerability is present in the endpoint 'api.1millionbot.com/api/public/conversations/<ID>' and, if exploited, could allow a remote attacker to access other users private chatbot conversations, revealing sensitive or confidential data without requiring credentials or impersonating users. In order for the vulnerability to be exploited, the attacker must have the user's conversation ID.
CVE
Identificador CVE Severidad Explotación Fabricante
CVE-2026-4399 Alta No 1millionbot
CVE-2026-4400 Alta No 1millionbot
References list
1millionbot webpage
Etiquetas