CVE-2026-118691: xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another user's cookieid, plus chosen chatid, touserid and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of xianyu-auto-reply-fix through 2.0.7 that expose the POST /send-message endpoint are affected when the publicly known default API secret is in use. An attacker can target a merchant account if they have that account's cookie_id.
What does an attacker need to send messages through the affected endpoint?
The attacker needs the hard-coded api_key, a target user's cookie_id, and values for chat_id, to_user_id, and message. No authentication is required by the endpoint.
What is the practical impact of successful exploitation?
An attacker can send arbitrary Xianyu messages to buyers from the targeted merchant account. The vulnerability affects message integrity rather than confidentiality or availability.