---
id: "CVE-2026-129139"
page: "https://infrastack.ai/live/CVE-2026-129139"
kind: "vulnerability"
aliases: ["CVE-2026-129139"]
title: "paicoding: predictable ZSXQ-login passwords let attackers take over accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "paicoding", "fixed": [], "affected": ">= b8206b97cc504b939ca6fdc46e0a8c3e816b14e9, <= 903adce70309d340f7eec51ec3c80cfe3c8326c1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "paicoding", "self-hosted", "zsxq-login"]
not_affected_if: ["no-zsxq-login", "outside-commit-range"]
published_at: "2026-11-13T18:17:38+00:00"
first_seen_at: "2026-11-13T18:49:29+00:00"
updated_at: "2026-11-13T18:54:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129139", "first_seen_at": "2026-11-13T18:49:29+00:00"}, {"source": "analyst", "url": "https://github.com/itwanger/paicoding/issues/137", "first_seen_at": "2026-11-13T18:54:39+00:00", "cites": ["https://github.com/itwanger/paicoding/issues/137"]}]
exploit_sources: []
---

# paicoding: predictable ZSXQ-login passwords let attackers take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-129139 (this .md is for agents)

paicoding derives both the username and password of accounts created through ZSXQ login solely from the member's ZSXQ number. An unauthenticated attacker who reads that number from a victim's public profile page can compute the credentials and log in as the victim.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:paicoding affected >= b8206b97cc504b939ca6fdc46e0a8c3e816b14e9, <= 903adce70309d340f7eec51ec3c80cfe3c8326c1 fixed no fixed version listed

## How to check

Check whether your paicoding checkout contains commits b8206b9 through 903adce and LoginServiceImpl.loginByZsxq. Then list accounts created via ZSXQ login: their username and password derive only from the ZSXQ number shown on the public /user/{userId} page.

## Fix

No fix published as of 2026-11-13; upstream issue #137 is open. Until then, disable ZSXQ login and reset passwords of accounts created via ZSXQ.

## Timeline

- 2026-11-13T18:49:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129139
- 2026-11-13T18:54:39+00:00 analyst https://github.com/itwanger/paicoding/issues/137 — VulnCheck advisory read (third-party CNA, not vendor). Upstream issue #137 still open as of 2026-11-13, no fix commit or release found. Affects commits b8206b9..903adce.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials
- [describes] paicoding #137 [SECURITY] 7 vulnerabilities (open, no fix) https://github.com/itwanger/paicoding/issues/137

## From the sources

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_