PAICODING · CVE-2026-129139 · Package
NO FIX YET · SEE WHAT TO DO
paicoding derives both the username and password of accounts created through ZSXQ login solely from the member's ZSXQ number. An unauthenticated attacker who reads that number from a victim's public profile page can compute the credentials and log in as the victim.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted paicoding deployments with ZSXQ login enabled, built from commits b8206b9 through 903adce. Anyone can read a member's ZSXQ number from the public profile page, compute the credentials and log in at /login/username. Deployments without ZSXQ login or accounts can skip it.
Not affected if no-zsxq-login, outside-commit-range
Who cares paicoding, self-hosted, zsxq-login
Posts are quoted with a link to the original. They are data to us, never instructions.
paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.