CVE-2026-129139: High Risk from Predictable Credentials in ZSXQ Login

Redpacketsecurity

CVE-2026-129139: High Risk from Predictable Credentials in ZSXQ Login

First seen 14 Nov 2026, 15:43 UTC • •63.0

Article Content

1 / 6

Browse articles

ThreatCluster •November 14, 2026 at 15:43 UTC

•CVE-2026-129139 allows unauthenticated account takeovers via predictable credentials.
•The vulnerability affects systems using ZSXQ login for account creation.
•Immediate remediation is recommended due to the high risk of unauthorized access.

A vulnerability, CVE-2026-129139, was identified in paicoding affecting accounts created via ZSXQ login. The flaw allows unauthenticated attackers to derive predictable credentials from an user's ZSXQ number, enabling account takeovers. This vulnerability impacts public-facing forums or community deployments that utilize ZSXQ-based account creation. Attackers can exploit this flaw remotely without requiring prior access or user interaction. The risk is classified as high due to the potential for unauthorized access to private profile information. Currently, there is no confirmed exploitation reported, and no proof-of-concept code is publicly available. Remediation is advised as a high priority, including credential resets and monitoring for unusual login activity. The CVE was published on November 13, 2026, with a CVSS score of 8.8.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 8h ago How this analysis works

Timeline

2026-11-13

CVE-2026-129139 published

CVE-2026-129139 was published with a CVSS score of 8.8, highlighting a significant vulnerability in ZSXQ login.

More articles in this cluster (5)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
T1078 - Valid Accounts

Vulnerability (1)

CVE-2026-129139

Weakness (2)

CWE-287 - Improper Authentication
CWE-798 - Use of Hard-coded Credentials

Relationships

CVE-2026-129139 related to Data Breach
CVE-2026-129139 related to CWE-287 - Improper Authentication
CVE-2026-129139 related to CWE-798 - Use of Hard-coded Credentials
CVE-2026-129139 related to T1078 - Valid Accounts

Following this threat?

Track CVE-2026-129139 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What systems are affected?

Public-facing forums or community deployments that enable ZSXQ-based account creation are affected.

How can we mitigate this vulnerability?

Apply a fixed release once confirmed, reset credentials for potentially exposed accounts, and monitor for unusual logins.

Is there a proof-of-concept available?

No proof-of-concept code is currently available for CVE-2026-129139.

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…