CVE-2026-118691
Low
Description
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
SeverityLow
CVSS3.7
Exploit probability—
ProductGudong2003 Xianyu-auto-reply-fix
PublishedOct 28, 2026
First seenNov 4, 2026
Weakness typeCWE-1188CWE-1188
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GuDong2003 xianyu-auto-reply-fix | v ≤ 2.0.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.