{"id":"CVE-2026-118691","title":"xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message","summary":"xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secr…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-1188"],"vendor":"GuDong2003","product":"xianyu-auto-reply-fix","affected":["xianyu-auto-reply-fix <= 2.0.7"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:01:14.916329Z"},"exploitAvailable":true,"published":"2026-10-28","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:01:21.201Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118691","references":[{"url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/issues/116","label":"GitHub Issue #116"},{"url":"https://github.com/GuDong2003/xianyu-auto-reply-fix"},{"url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/reply_server.py#L2347-L2475"},{"url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/db_manager.py#L1011"},{"url":"https://github.com/GuDong2003/xianyu-auto-reply-fix/commit/999cfe61c401322d9893eb81ad1a76beabba6cfb"},{"url":"https://www.vulncheck.com/advisories/xianyu-auto-reply-fix-through-2.0.7-unauthenticated-message-sending-via-send-message","label":"VulnCheck Advisory: xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message"}],"tags":["cve.org","exploit-available"],"epss":0.00316,"epssPercentile":0.24639,"ingestedAt":"2026-10-30T21:09:21.614Z","slug":"CVE-2026-118691","body":"## Overview\n\nxianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.\n\n## Affected\n\n- `xianyu-auto-reply-fix <= 2.0.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":233727,"id":"CVE-2026-118691","ts":1793910827482,"field":"exploit_available","old":"false","new":"true"}]}