{"id":"CVE-2026-118691","kind":"vulnerability","aliases":["CVE-2026-118691"],"related":[],"title":"xianyu-auto-reply-fix: unauthenticated message sending via hard-coded default API key","description":"xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.","summary":"The xianyu-auto-reply-fix project through version 2.0.7 exposes a POST /send-message endpoint that lacks proper authorization checks. An attacker who knows the publicly documented default API key and another user's cookie_id can send arbitrary Xianyu messages to buyers from that merchant's account.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","other","self-hosted","xianyu","xianyu-auto-reply-fix"],"not_affected_if":["custom-api-secret","not-internet-exposed"],"how_to_check":"- Check whether the deployment still uses the default API secret shipped in the project configuration.\n- Confirm the installed version with the project's version file or `git describe` and compare it against `2.0.7`.\n- Test whether `POST /send-message` accepts requests carrying only the default api_key, without a valid session.","fix":"- Upgrade past `2.0.7` to a release that adds authorization on `POST /send-message` (unknown in sources).\n- Replace the default API secret with a unique random value and rotate any credentials derived from it.\n- Restrict network access to the endpoint to trusted hosts until patched.","status":"open","published_at":"2026-10-28T22:17:13+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:59+00:00","updated_at":"2026-10-28T22:36:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T22:36:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past `2.0.7` to a release that adds authorization on `POST /send-message` (unknown in sources).\n- Replace the default API secret with a unique random value and rotate any credentials derived from it.\n- Restrict network access to the endpoint to trusted hosts until patched.","reach":"internet","title":"xianyu-auto-reply-fix: unauthenticated message sending via hard-coded default API key","impact":"medium","summary":"The xianyu-auto-reply-fix project through version 2.0.7 exposes a POST /send-message endpoint that lacks proper authorization checks. An attacker who knows the publicly documented default API key and another user's cookie_id can send arbitrary Xianyu messages to buyers from that merchant's account.","category":"other","nicknames":[],"who_cares":["xianyu-auto-reply-fix","self-hosted","xianyu","e-commerce"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker sends messages to buyers from a merchant's Xianyu account.","analyst_note":"Confirm the fixed version after 2.0.7 and whether the default secret is the only precondition; check the project repository linked from NVD.","how_to_check":"- Check whether the deployment still uses the default API secret shipped in the project configuration.\n- Confirm the installed version with the project's version file or `git describe` and compare it against `2.0.7`.\n- Test whether `POST /send-message` accepts requests carrying only the default api_key, without a valid session.","needs_analyst":true,"not_affected_if":["custom-api-secret","not-internet-exposed"],"who_is_affected":"Any deployment of xianyu-auto-reply-fix up to and including 2.0.7 that is reachable from the internet or an untrusted network and still uses the publicly known default API secret is exposed. Instances with a changed secret, or that are not reachable by untrusted clients, are much less exposed. The sources do not say whether the flaw depends on any other configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":3373,"output_tokens":720,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118691':18A,21A '-2026':17A,20A '/send-message':48B,98C '2.0.7':44B,89C 'account':82B,110C,152C 'allow':101C 'anoth':66B,127C 'api':14A,63B,115C,124C 'arbitrari':73B,144C 'attack':56B,103C,117C 'author':53B,93C 'auto':3A,32B,38B,85C 'buyer':77B,148C 'chat':134C 'check':54B 'chosen':133C 'code':12A,123C 'commerc':24B 'contain':90C 'cooki':69B,130C 'cve':16A,19A 'default':13A,62B,114C 'document':61B 'e':23B 'e-commerc':22B 'endpoint':49B,99C 'expos':45B 'fix':5A,34B,40B,87C 'hard':11A,122C 'hard-cod':10A,121C 'host':28B 'id':70B,131C,135C,138C 'key':15A,64B,125C 'know':58B 'known':113C 'lack':51B 'merchant':80B,151C 'messag':7A,75B,106C,140C,146C 'miss':92C 'plus':132C 'post':47B,97C 'project':41B 'proper':52B 'public':60B,112C 'repli':4A,33B,39B,86C 'secret':116C 'self':27B 'self-host':26B 'send':8A,72B,105C,143C 'suppli':119C 'unauthent':6A,102C 'use':111C 'user':67B,109C,128C,137C 'valu':141C 'version':43B 'via':9A 'vulner':94C 'xianyu':2A,29B,31B,37B,74B,84C,145C 'xianyu-auto-reply-fix':1A,30B,36B,83C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of xianyu-auto-reply-fix up to and including 2.0.7 that is reachable from the internet or an untrusted network and still uses the publicly known default API secret is exposed. Instances with a changed secret, or that are not reachable by untrusted clients, are much less exposed. The sources do not say whether the flaw depends on any other configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118691","severity":null,"published_at":"2026-10-28T22:17:13+00:00","modified_at":"2026-10-28T22:17:13+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}