CVE-2026-58466

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73
https://github.com/EstrellaXD/Auto_Bangumi/issues/1041
https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8
https://www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) AutoBangumi antes de la versión 3.2.8 contiene una vulnerabilidad de credenciales predeterminadas codificadas de forma rígida que permite a atacantes no autenticados autenticarse como el administrador mediante el uso de las credenciales predeterminadas conocidas públicamente, sembradas al inicio a través de add_default_user() en el módulo de usuario de la base de datos cuando la tabla de usuarios está vacía. Los atacantes pueden enviar las credenciales predeterminadas al punto final de inicio de sesión de autenticación para obtener control total de la aplicación, incluyendo la configuración de fuentes RSS, la configuración del descargador y todos los puntos finales de API autenticados.

Information

Published : 2026-07-02 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-58466

Mitre link : CVE-2026-58466

CVE.ORG link : CVE-2026-58466

JSON object : View

Products Affected

No product.

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2026-58466", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58466", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T12:32:02.154896Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/EstrellaXD/Auto_Bangumi", "vendor": "EstrellaXD", "product": "Auto_Bangumi", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.8", "versionType": "custom"}], "packageURL": "pkg:github/EstrellaXD/Auto_Bangumi", "defaultStatus": "unaffected"}]}], "published": "2026-07-02T20:17:06.593", "references": [{"url": "https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/EstrellaXD/Auto_Bangumi/issues/1041", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints."}, {"lang": "es", "value": "AutoBangumi antes de la versi\u00f3n 3.2.8 contiene una vulnerabilidad de credenciales predeterminadas codificadas de forma r\u00edgida que permite a atacantes no autenticados autenticarse como el administrador mediante el uso de las credenciales predeterminadas conocidas p\u00fablicamente, sembradas al inicio a trav\u00e9s de add_default_user() en el m\u00f3dulo de usuario de la base de datos cuando la tabla de usuarios est\u00e1 vac\u00eda. Los atacantes pueden enviar las credenciales predeterminadas al punto final de inicio de sesi\u00f3n de autenticaci\u00f3n para obtener control total de la aplicaci\u00f3n, incluyendo la configuraci\u00f3n de fuentes RSS, la configuraci\u00f3n del descargador y todos los puntos finales de API autenticados."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}