Description
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
Published: 2026-10-28
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
Title xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
Weaknesses CWE-1188
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T21:11:18.629Z

Reserved: 2026-10-28T17:31:29.498Z

Link: CVE-2026-118691

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T22:17:13.217

Modified: 2026-10-28T22:17:13.217

Link: CVE-2026-118691

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T22:30:12Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default