Low severity · published Oct 28, 2026
CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
New
3.7
CVSS
–
EPSS
No
On KEV
Description
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XI
xianyu-auto-reply-fix · GuDong2003
through 2.0.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118691
github.com
https://github.com/GuDong2003/xianyu-auto-reply-fix
github.com
https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/db_manager.py#L1011
github.com
https://github.com/GuDong2003/xianyu-auto-reply-fix/blob/v2.0.7/reply_server.py#L2347-L2475
github.com
https://github.com/GuDong2003/xianyu-auto-reply-fix/commit/999cfe61c401322d9893eb81ad1a76beabba6cfb
github.com
https://github.com/GuDong2003/xianyu-auto-reply-fix/issues/116
www.vulncheck.com
https://www.vulncheck.com/advisories/xianyu-auto-reply-fix-through-2.0.7-unauthenticated-message-sending-via-send-message