Junglewise Threat Intelligence

CVE-2026-58466: EstrellaXD AutoBangumi hard-coded default credentials in database user module

CVE-2026-58466 · Severity: critical · CVSS 9.8 · Published 2026-07-02

Executive brief

AutoBangumi, an automated tool for managing media downloads, contains a security flaw where it automatically creates an administrator account with publicly known default credentials during its initial setup. An attacker can use these well-known credentials to log in remotely without any prior authorization. Once logged in, the attacker gains full control over the application, allowing them to modify download settings, access private data, and take over the entire service.

Technical details

AutoBangumi versions prior to 3.2.8 are vulnerable to the use of hard-coded default credentials (CWE-1392). The vulnerability exists in the database user module's `add_default_user()` function, which seeds the database with a default administrator account if the users table is empty at startup. A remote, unauthenticated attacker can exploit this by submitting these publicly known credentials to the authentication login endpoint. Successful exploitation grants the attacker full administrative access to the application, including the ability to configure RSS feeds, manage downloader settings, and access all authenticated API endpoints. The issue was addressed in version 3.2.8 by hardening pre-authentication setup endpoints.

Affected products

  • EstrellaXD AutoBangumi before 3.2.8

Timeline

  • 2026-06-09: disclosed: Initial security issue reported regarding related SSRF and setup hardening.
  • 2026-07-02: patched: Version 3.2.8 released to address setup vulnerabilities.
  • 2026-07-02: advisory: CVE-2026-58466 published.

References

Related threats