paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

Advisories

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

Severity: high
Date: 11/13/2026
Affecting: paicoding >= b8206b97cc504b939ca6fdc46e0a8c3e816b14e9, <= 903adce70309d340f7eec51ec3c80cfe3c8326c1
CVE: CVE-2026-129139
CWE: CWE-1391 Use of Weak Credentials
CVSS: 8.8
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://vul.yulun.ac.cn/20261112/paicoding/
https://github.com/itwanger/paicoding/issues/137
https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/user/service/user/LoginServiceImpl.java#L244-L250
https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/views/user/info/edit.html#L81-L90
Credit: Wu Yulun
Description: paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo