CVE-2026-85030: HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routesagent.py of the component selfRegister API Endpoint. Such manipulation of the argument initialbalance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profitpercentfordisplay() divides by INITIALCAPITAL + deposited, and challenge scoring's returnpct also normalises against the attacker-inflated startingcash. So an inflated initialbalance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely and does not require privileges or user interaction. Exploitation is characterized as high complexity and difficult.
What is the practical impact of manipulating the balance value?
Inflating initial_balance raises displayed absolute cash and equity values, creating a cosmetic or simulated-game leaderboard-gaming concern. It does not create artificial percentage returns because displayed profit and challenge return percentages are normalized using the inflated starting amount.
Is public exploit information available?
Yes. An exploit has been publicly disclosed and may be used.
Can affected deployments be identified by a release version?
No fixed affected or updated release versions are provided because the product uses a rolling-release delivery model. The affected code is identified as service/server/routes_agent.py in revisions up to d03ff6c056b32ced735adf7c19ed8175adb1c8df.