Moltbook Misconfiguration Vulnerability

A misconfigured Supabase database, with an exposed API key in client-side JavaScript and disabled Row Level Security (RLS), granted unauthenticated full read and write access to the Moltbook platform's production data. This vulnerability resulted in the exfiltration of 1.5 million API authentication tokens, over 64,000 email addresses, private messages containing third-party API credentials, and enabled unauthorized content modification.

What Happened

A misconfigured Supabase database, with an exposed API key in client-side JavaScript and disabled Row Level Security (RLS), granted unauthenticated full read and write access to the Moltbook platform's production data. This vulnerability resulted in the exfiltration of 1.5 million API authentication tokens, over 64,000 email addresses, private messages containing third-party API credentials, and enabled unauthorized content modification.

Why This Matters

Publisher reporting describes a security event affecting over. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether over is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Feb 02, 2026 05:30

  BugSkan first recorded this incident.

• Hacking Moltbook: AI Social Network Reveals 1.5M API Keys - wiz.io
  Feb 02, 2026 05:30

  wiz.io · Data Leak

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match