Predictable Credential Vulnerability in Paicoding's Account Login Feature
CVE-2026-129139

8.8HIGH

Key Information:

Vendor

Itwanger

Status
Paicoding
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129139?

The Paicoding login service has a significant security flaw due to the use of predictable credentials for accounts created via ZSXQ login. The login method derives both the username and password solely from a user's ZSXQ number, which can be easily accessed from a user's profile page. This allows unauthenticated attackers to compute the credentials and gain unauthorized access to user accounts. Appropriate measures need to be taken to improve credential generation and enhance account security.

Affected Version(s)

paicoding b8206b97cc504b939ca6fdc46e0a8c3e816b14e9 <= 903adce70309d340f7eec51ec3c80cfe3c8326c1

References

https://vul.yulun.ac.cn/20261112/paicoding/
third-party-advisory
https://github.com/itwanger/paicoding/issues/137
issue-tracking
https://github.com/itwanger/paicoding/blob/903adce70309d3...
technical-description

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.