CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118691?
CVE-2026-118691 is a medium-severity vulnerability in GuDong2003 xianyu-auto-reply-fix, published on 28 Oct 2026.
Official description
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
Weakness: CWE-1188
Which versions are affected by CVE-2026-118691?
How do I fix CVE-2026-118691?
No fix has been published for CVE-2026-118691 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118691 being exploited?
There is no known exploitation of CVE-2026-118691 in the wild and no public exploit code.
Sources
Also known as GHSA-8xg3-rxxw-rm99.