CVE-2026-129139: paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials
paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to account takeover?
Accounts created through ZSXQ login are exposed if they were created in the affected commit range. An unauthenticated attacker can target a victim whose ZSXQ number is visible on that victim's /user/{userId} profile page.
What does an attacker need to exploit this issue?
The attacker only needs the victim's ZSXQ number, which can be read from the public profile page, and can derive the username and password from it. No existing account, privileges, or user interaction are required.
How can administrators determine whether a user may already be affected?
Review whether the deployment includes commits b8206b9 through 903adce and identify accounts created via ZSXQ login. Those accounts should be treated as susceptible when their ZSXQ number is exposed through /user/{userId}.