PT-2026-55288 · Unknown · Auto Bangumi

George Chen · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-58466

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AutoBangumi versions prior to 3.2.8

Description An issue exists where hard-coded default credentials are seeded at startup via the add default user() function in the database user module when the users table is empty. This allows unauthenticated attackers to authenticate as the administrator by submitting these credentials to the authentication login endpoint. Successful exploitation grants full control of the application, including the downloader configuration, RSS feed configuration, and all authenticated API endpoints.

Recommendations Update to version 3.2.8 or later.

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2026-58466

Affected Products

Auto Bangumi

References · 8

• https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58466 · Security Note
• https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8 · Note
• https://github.com/EstrellaXD/Auto_Bangumi/issues/1041 · Note
• https://vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user · Note
• https://twitter.com/infoflowcloud/status/2072815491417063829 · Twitter Post
• https://twitter.com/OrizonCyber/status/2072779891079037422 · Twitter Post
• https://twitter.com/CVEnew/status/2072814577591751141 · Twitter Post