CVE Alert: CVE-2026-129139 – itwanger

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member’s ZSXQ number. Unauthenticated attackers can read that number from the victim’s /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

**Risk verdict:** High risk: the attack appears remotely achievable without an existing account or victim action, but urgency cannot be calibrated without exploitation-status and probability data.

**Why this matters:** An attacker could take control of user accounts and access private profile information, then make changes or impersonate users. This creates privacy, trust and support burdens; broader business impact depends on what account permissions expose.

**Most likely attack path:** An unauthenticated attacker can reach the service over the network, with low complexity and no user interaction or prior privileges required. The vulnerable login flow provides a path to account access; scope is unchanged, so the supplied metrics do not indicate automatic impact on separate systems. No KEV, SSVC, PoC or EPSS data was supplied, leaving observed exploitation and likelihood uncertain.

**Who is most exposed:** Public-facing forum or community deployments that enable ZSXQ-based account creation are the clearest concern, especially where profiles disclose account identifiers.

Review successful username logins following profile-page access or account discovery.

Look for unusual logins to ZSXQ-linked accounts, including new locations or devices.

Check for unexpected email, password or profile changes and subsequent sessions.

Mitigation and prioritisation:

Apply a fixed release once confirmed; treat remediation as high priority.

Temporarily disable the affected login or account-creation flow if patching is delayed.

Reset credentials for potentially exposed accounts and invalidate their active sessions.

Review the change in staging, then deploy promptly with monitoring for login disruption.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.