---
id: CVE-2026-118691
title: >-
  xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via
  /send-message
summary: >-
  xianyu-auto-reply-fix through 2.0.7 contains a missing authorization
  vulnerability in the POST /send-message endpoint that allows unauthenticated
  attackers to send messages from other users' accounts using publicly known
  default API secr…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-1188
vendor: GuDong2003
product: xianyu-auto-reply-fix
affected:
  - xianyu-auto-reply-fix <= 2.0.7
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:01:14.916329Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:01:21.201Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118691'
references:
  - url: 'https://github.com/GuDong2003/xianyu-auto-reply-fix/issues/116'
    label: 'GitHub Issue #116'
  - url: 'https://github.com/GuDong2003/xianyu-auto-reply-fix'
  - url: >-
      https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/reply_server.py#L2347-L2475
  - url: >-
      https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/db_manager.py#L1011
  - url: >-
      https://github.com/GuDong2003/xianyu-auto-reply-fix/commit/999cfe61c401322d9893eb81ad1a76beabba6cfb
  - url: >-
      https://www.vulncheck.com/advisories/xianyu-auto-reply-fix-through-2.0.7-unauthenticated-message-sending-via-send-message
    label: >-
      VulnCheck Advisory: xianyu-auto-reply-fix through 2.0.7 Unauthenticated
      Message Sending via /send-message
tags:
  - cve.org
  - exploit-available
epss: 0.00316
epssPercentile: 0.24639
ingestedAt: '2026-10-30T21:09:21.614Z'
---

## Overview

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.

## Affected

- `xianyu-auto-reply-fix <= 2.0.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.