CVE-2026-118691 Details
Description
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
A missing authorization vulnerability has been identified in the Xianyu Auto Reply Fix application, specifically in versions through 2.0.7. The vulnerability exists in the POST /send-message endpoint, where unauthenticated attackers can send messages from other users' accounts by using publicly known default API secrets. Exploitation involves supplying the hard-coded api_key, another user's cookie_id, and selected chat_id, to_user_id, and message values. This allows attackers to send arbitrary Xianyu messages to buyers from the targeted merchant account.
Users should update to Xianyu Auto Reply Fix version 2.0.7 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GuDong2003 xianyu-auto-reply-fix | <= 2.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |