Vulnerability in Estrellaxd Auto Bangumi
CVE-2026-58466
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.
EPSS: 0.005 (40.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Estrellaxd Auto_bangumi — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58466?
- CVE-2026-58466 is a critical-severity vulnerability in Estrellaxd Auto Bangumi, classified under CWE-1392. CVSS score: 9.8/10. Published 2026-07-02.
- How severe is CVE-2026-58466?
- Critical severity. CVSS v3 base score is 9.8 out of 10.