CVE-2026-58466 | BDVDB-2026-345338 Detail
EstrellaXDAuto_Bangumi
Description#
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-1392 Use of Default Credentials
References#
- https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8
- https://github.com/EstrellaXD/Auto_Bangumi/issues/1041
- https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73
- https://www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.