Improper Authentication in botframework-connector
Summary
CVE-2021-1725: botframework-connector vulnerable to Improper Authentication. Affects botframework-connector across 4 version ranges.
>= 4.7.0, < 4.7.2
>= 4.8.0, < 4.8.1
>= 4.9.0, < 4.9.3
>= 4.10.0, < 4.10.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- botframework-connector · npm
The same CVE-2021-1725 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The botframework-connector package is a Python library that provides functionality for interacting with the Microsoft Bot Framework. It allows developers to build and connect bots to various channels, such as Microsoft Teams, Skype, and Slack. The package facilitates communication between the bot and the channels, handling authentication, message processing, and other tasks. However, a vulnerability has been discovered in the package that could lead to improper authentication.
Vulnerability Detail
The vulnerability in botframework-connector is related to improper authentication. A maliciously crafted claim can be incorrectly authenticated by the bot, impacting bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. If exploited, an attacker could gain unauthorized access or perform unauthorized actions within the bot's context. The vulnerability has been assigned a severity rating of HIGH and is categorized as CWE-287.
How To Fix
Latest published version: 4.17.1 as of 23 Oct 2026
pip install --upgrade "botframework-connector==4.17.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.7.0, < 4.7.24.7.2pip install --upgrade "botframework-connector==4.7.2" -
>= 4.8.0, < 4.8.14.8.1pip install --upgrade "botframework-connector==4.8.1" -
>= 4.9.0, < 4.9.34.9.3pip install --upgrade "botframework-connector==4.9.3" -
>= 4.10.0, < 4.10.14.10.1pip install --upgrade "botframework-connector==4.10.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to the patched version, you can implement the following workaround:
Add an authentication configuration containing ClaimsValidator, which throws an exception if Claims are Skill Claims. This will help mitigate the vulnerability by preventing the incorrect authentication of maliciously crafted claims. Here is an example of how to add the configuration:
from botframework.connector.auth import ClaimsValidator
# Add the following code to your bot initialization
auth_config = {
'claims_validator': ClaimsValidator()
}
# Pass the auth_config to your bot
bot = MyBot(auth_config=auth_config)
Please refer to the advisory's References section for more detailed instructions.
Conclusion
In conclusion, the botframework-connector package is vulnerable to improper authentication, which can be exploited by a malicious attacker with internal knowledge of the bot. It is recommended to upgrade to the patched version of the package or implement the provided workaround. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for botframework-connector →
FAQ
The vulnerability allows a malicious attacker with internal knowledge of the bot to incorrectly authenticate a maliciously crafted claim. This can lead to unauthorized access or unauthorized actions within the bot's context.
Bots that are not configured to be used as a Skill are affected by this vulnerability. Users who have configured their bots as Skills are not impacted.
The vulnerability can be fixed by upgrading to the patched version of the botframework-connector package. If upgrading is not possible, a workaround is available by adding an authentication configuration containing ClaimsValidator.
There are no known exploits of this vulnerability at the time of this advisory. However, it is recommended to apply the necessary patches or workarounds to mitigate the risk.
For more information about this vulnerability, you can open an issue in the Microsoft Bot Builder SDK repository or email bf-reports@microsoft.com.
