---
id: "CVE-2026-118691"
kind: "vulnerability"
aliases: ["CVE-2026-118691"]
title: "xianyu-auto-reply-fix: unauthenticated message sending via hard-coded default API key"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["e-commerce", "other", "self-hosted", "xianyu", "xianyu-auto-reply-fix"]
not_affected_if: ["custom-api-secret", "not-internet-exposed"]
published_at: "2026-10-28T22:17:13+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118691", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# xianyu-auto-reply-fix: unauthenticated message sending via hard-coded default API key

The xianyu-auto-reply-fix project through version 2.0.7 exposes a POST /send-message endpoint that lacks proper authorization checks. An attacker who knows the publicly documented default API key and another user's cookie_id can send arbitrary Xianyu messages to buyers from that merchant's account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment still uses the default API secret shipped in the project configuration.
- Confirm the installed version with the project's version file or `git describe` and compare it against `2.0.7`.
- Test whether `POST /send-message` accepts requests carrying only the default api_key, without a valid session.

## Fix

- Upgrade past `2.0.7` to a release that adds authorization on `POST /send-message` (unknown in sources).
- Replace the default API secret with a unique random value and rotate any credentials derived from it.
- Restrict network access to the endpoint to trusted hosts until patched.

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118691

## From the sources

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_