Threats tagged 'ghsa-8xg3-rxxw-rm99'

xianyu-auto-reply-fix versions through 2.0.7 have a missing authorization vulnerability in the POST /send-message endpoint. This flaw allows unauthenticated attackers to send messages on behalf of other users by exploiting publicly known default API secrets. Attackers can use a hard-coded api_key along with another user's cookie_id and chosen message parameters to send arbitrary messages from that merchant account.