EUVD-2026-112492

xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...

CVE-2026-118691

The xianyu-auto-reply-fix tool (versions through 2.0.7 ) is vulnerable to missing authorization in the POST /send-message endpoint. This flaw allows unauthenticated attackers to send arbitrary messages from other users' accounts by utilizing publicly known default API secrets . Specifically, an a...