CVE-2025-69207: 
Python vulnerability analysis and mitigation

CVE-2025-69207 is an Insecure Direct Object Reference (IDOR) vulnerability in the Notion OAuth callback flow of Khoj, a self-hostable AI application. It allows an unauthenticated attacker to hijack any user's Notion integration by manipulating the state parameter in the OAuth callback, replacing the victim's Notion configuration with attacker-controlled data and poisoning their Khoj search index. All Khoj versions prior to 2.0.0-beta.23 are affected, including all pre-2.0.0 releases and beta versions up to 2.0.0-beta.22. The vulnerability was disclosed on February 1, 2026, and carries a CVSS v3.1 base score of 7.1 (High) per Feedly/NVD, though the GitHub Advisory rates it 5.4 (Moderate) (GitHub Advisory, Khoj Security Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The vulnerable endpoint GET /notion/auth/callback in src/khoj/routers/notion.py accepts a state query parameter and uses it directly to look up a user via aget_user_by_uuid(state) without verifying that the authenticated session initiated the OAuth flow for that UUID. An attacker who knows a victim's UUID can initiate their own Notion OAuth flow, intercept the callback, and substitute the victim's UUID as the state parameter — causing the endpoint to delete the victim's existing Notion configuration and store the attacker's Notion access token under the victim's account. The victim's UUID can be obtained by inspecting shared conversations that contain AI-generated images, where the file path is constructed using the user's UUID (GitHub Advisory, Khoj Security Advisory).

Successful exploitation allows an attacker to delete a victim's existing Notion sync configuration and replace it with attacker-controlled Notion credentials, resulting in data poisoning of the victim's Khoj search index. If synced Notion content is passed as context to the underlying LLM, this could enable prompt injection or manipulation of AI-generated responses for the victim. The attack has a high integrity impact (attacker controls what data is indexed) and low confidentiality impact (attacker may gain indirect access to search index contents), with no direct availability impact (GitHub Advisory, Feedly).

A proof-of-concept is publicly documented in the GitHub Security Advisory, including the vulnerable code path and step-by-step exploitation method, making this straightforward to exploit for anyone with knowledge of a target's UUID. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.01%, indicating a low near-term exploitation probability. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance – Obtain victim UUID: Access a shared Khoj conversation that contains an AI-generated image. Inspect the image file path in the conversation, which is constructed using the victim user's UUID (e.g., /path/<victim-uuid>/image.png).
2. Initiate OAuth flow: On an attacker-controlled Khoj account, begin the Notion integration/sync process to generate a valid OAuth authorization code from Notion.
3. Intercept the OAuth callback: Using a proxy tool (e.g., Burp Suite), intercept the OAuth callback request sent to GET /notion/auth/callback?code=<code>&state=<attacker-uuid>.
4. Substitute victim UUID: Replace the state parameter value with the victim's UUID: GET /notion/auth/callback?code=<code>&state=<victim-uuid>.
5. Trigger account takeover: The server calls aget_user_by_uuid(state) with the victim's UUID (no session verification), deletes the victim's existing Notion configuration, and stores the attacker's Notion access token under the victim's account.
6. Achieve index poisoning: The attacker's Notion workspace is now synced to the victim's Khoj instance, poisoning their search index with attacker-controlled content (GitHub Advisory, Khoj Security Advisory).

• Logs: Unexpected GET /notion/auth/callback requests where the state parameter does not match the authenticated session's user UUID; log entries showing NotionConfig deletion followed by creation for a user who did not initiate a Notion sync.
• Application Behavior: Victims report their Notion integration unexpectedly disconnected or replaced; Khoj search results contain unfamiliar or attacker-controlled content from a different Notion workspace.
• Network: OAuth callback requests originating from IP addresses inconsistent with the victim's known access patterns, particularly with mismatched state parameters.
• Database: NotionConfig records for users updated at unexpected times without corresponding user-initiated OAuth flows (GitHub Advisory).

Upgrade Khoj to version 2.0.0-beta.23 or later, which resolves the vulnerability by adding the @requires(["authenticated"]) decorator to the callback endpoint and using the authenticated session user (request.user.object) instead of the attacker-controlled state parameter, with an additional CSRF check verifying that state matches the authenticated user's UUID (Khoj Release, Patch Commit). As an interim measure for those unable to upgrade immediately, disable the Notion integration feature or restrict access to the /notion/auth/callback endpoint. After upgrading, review all existing Notion integrations in your Khoj instance to verify they have not been tampered with, and audit shared conversations containing AI-generated images for potential UUID exposure.

The vulnerability was reported by security researcher Cillian-Collins and acknowledged by Khoj maintainer debanjum, who published the advisory and patch on February 1, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory, Khoj Security Advisory).