CVE-2026-85030: Business Logic Errors in HKUDS AI-Trader
Description
A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.
CVSS v4.0
Score 6.3medium
Affected software
HKUDS
AI-Trader
cpe:2.3:a:hkuds:ai-trader:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in HKUDS AI-Trader arises from improper handling of the initial_balance parameter in the selfRegister API endpoint within service/server/routes_agent.py. Manipulating this argument causes business logic errors that inflate the absolute cash or equity displayed, but do not affect normalized percentage returns or challenge scoring. The exploit is remote and complex, with no privileges or user interaction required, but it only impacts cosmetic display values rather than actual game scoring or financial calculations. The product uses a rolling release model, so no fixed affected or patched versions are specified.
Potential Impact
The impact is limited to cosmetic leaderboard manipulation by inflating absolute cash/equity values. There is no impact on actual profit percentage calculations or challenge scoring, which normalize against the attacker-inflated starting cash. Therefore, the vulnerability does not affect the integrity of game scoring or financial outcomes, only the displayed values, which may mislead users about relative performance.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the rolling release nature of the product, specific version fixes are not identified. Users should monitor vendor communications for updates. Since the impact is cosmetic and does not affect scoring integrity, immediate urgent remediation is not indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-02T20:07:26.182Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a995435acd9273b49d419f1
Added to database: 09/03/2026, 11:04:21 UTC
Last enriched: 09/07/2026, 11:31:46 UTC
Last updated: 10/18/2026, 06:48:20 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.