Threats affecting pkg:github/gudong2003/xianyu-auto-reply-fix

CVE-2026-118691 is a vulnerability in GuDong2003's xianyu-auto-reply-fix up to version 2.0.7. It involves a missing authorization check in the POST /send-message endpoint, allowing unauthenticated attackers to send messages on behalf of other users by exploiting publicly known default API secrets. Attackers can use a hard-coded api_key along with another user's cookie_id and arbitrary message parameters to send unauthorized messages.