Live › vulnerability › CVE-2026-118691
Go to dashboardThe xianyu-auto-reply-fix project through version 2.0.7 exposes a POST /send-message endpoint that lacks proper authorization checks. An attacker who knows the publicly documented default API key and another user's cookie_id can send arbitrary Xianyu messages to buyers from that merchant's account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Any deployment of xianyu-auto-reply-fix up to and including 2.0.7 that is reachable from the internet or an untrusted network and still uses the publicly known default API secret is exposed. Instances with a changed secret, or that are not reachable by untrusted clients, are much less exposed. The sources do not say whether the flaw depends on any other configuration.
No product ranges from the sources yet.
git describe and compare it against 2.0.7.POST /send-message accepts requests carrying only the default api_key, without a valid session.2.0.7 to a release that adds authorization on POST /send-message (unknown in sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
This page as .md · .json · in your agent: get_signal("CVE-2026-118691")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.