CVE-2026-114108

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...

EUVD-2026-106911

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/id/messages to trigger root shell...