PT-2026-129194
CVE-2026-118691
·
تاريخ النشر
2026-10-28
·
تاريخ التحديث
2026-10-28
الوصف من
CVSS 3.1
3.7
منخفضةالمقاييسAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api key and another user's cookie id, plus chosen chat id, to user id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾