Vulnerability in Estrellaxd Auto Bangumi
CVE-2026-58466
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Estrellaxd Auto Bangumi — versions 0
Weakness classification (CWE)
References
- github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6… (patch)
- github.com/EstrellaXD/Auto_Bangumi/issues/1041 (issue-tracking)
- github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8 (release-notes)
- www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58466?
- CVE-2026-58466 is a critical-severity vulnerability in Estrellaxd Auto Bangumi, classified under CWE-1392. CVSS score: 9.8/10. Published 2026-07-02.
- How severe is CVE-2026-58466?
- Critical severity. CVSS v3 base score is 9.8 out of 10.