Which versions of AutoBangumi are affected by CVE-2026-58466?

AutoBangumi versions prior to 3.2.8 contain hard-coded default administrator credentials that enable any unauthenticated remote attacker to gain full administrative access over RSS feed…. A patch is available.

How to fix or mitigate CVE-2026-58466?

**24 hours**: Conduct inventory of all AutoBangumi instances and document versions; immediately isolate or disable any running versions prior to 3.2.8. **7 days**: Upgrade AutoBangumi to version 3.2.8 or later on all instances and verify successful deployment. **30 days**: Review security logs for unauthorized access attempts during vulnerable period and confirm complete patch deployment across the environment.

AutoBangumi CVE-2026-58466

Q: What is the CVSS score of CVE-2026-58466?

CVE-2026-58466 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41435 CRITICAL

Use of Default Credentials (CWE-1392)

2026-07-02 VulnCheck

GHSA-q3h2-6968-258w

Information Disclosure Auto Bangumi

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Publicly known default credentials give unauthenticated network login (PR:N/UI:N/AC:L) yielding full admin control over config and data, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:35 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.

AnalysisAI

Authentication bypass via hard-coded default credentials in AutoBangumi before 3.2.8 lets unauthenticated remote attackers log in as administrator using publicly known credentials that the application seeds at startup via add_default_user() whenever the users table is empty. Successful login grants full control over RSS feed and downloader configuration and every authenticated API endpoint (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the credentials are public and exploitation is trivial against any un-upgraded, freshly-initialized instance.

Technical ContextAI

AutoBangumi (vendor 'estrellaxd', CPE cpe:2.3:a:estrellaxd:auto_bangumi) is a self-hosted automation tool that watches RSS feeds and drives a downloader to fetch anime episodes. The flaw is CWE-1392 (Use of Default Credentials): the database user module's add_default_user() routine automatically inserts a well-known administrator account when it detects an empty users table on first startup, and those credentials are documented/derivable from the public source. Because the seed happens automatically and the credentials are never forced to be rotated, any deployment that has not created its own admin - or was freshly initialized - exposes a known login to the network-facing authentication endpoint.

RemediationAI

Upgrade to AutoBangumi 3.2.8 or later, which contains the fix (Vendor-released patch: 3.2.8; release https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8, patch commit 487bdfec545e805ae416e6ddf28651bd274d6a73). After upgrading, immediately change the administrator password so any previously seeded default credential is invalidated. If you cannot upgrade right away, log in and replace the default admin credentials with a strong unique password (removing the known-secret exposure), and restrict network exposure of the login endpoint by placing AutoBangumi behind a VPN, reverse-proxy authentication, or firewall rules that limit access to trusted hosts - the trade-off being reduced convenience of remote access. Avoid leaving a fresh install running with an empty users table exposed to untrusted networks, since that is precisely the state that triggers auto-seeding of the default account.