CVE-2026-58169

Vibe-Trading before 0.1.10's local API server trusts the TCP peer address to bypass the APIAUTHKEY bearer-token check for loopback clients and performs no Host header validation, while binding to 0.0.0.0 with credentialed CORS by default. A DNS-rebinding web page can therefore issue authenticated...