Missing Authorization Vulnerability in Xianyu Auto Reply Fix by GuDong

CVE-2026-118691

What is CVE-2026-118691?

The Xianyu Auto Reply Fix plugin, up to version 2.0.7, is susceptible to a missing authorization vulnerability at the POST /send-message endpoint. This flaw enables unauthenticated attackers to leverage publicly known default API secrets, facilitating message sending from other users' accounts. By supplying a hard-coded api_key along with a user's cookie_id and the desired chat_id, to_user_id, and message content, attackers can dispatch arbitrary messages on behalf of those accounts, posing a significant threat to user privacy and data integrity.

References