CVE-2026-129139
paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.
| CWE | CWE-1391 |
| Vendor | itwanger |
| Product | paicoding |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for itwanger paicoding
Be the first to know when new high vulnerabilities affecting itwanger paicoding are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
itwanger / paicoding
b8206b97cc504b939ca6fdc46e0a8c3e816b14e9 ≤ 903adce70309d340f7eec51ec3c80cfe3c8326c1
References
vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261112/paicoding/ github.com: https://github.com/itwanger/paicoding/issues/137 github.com: https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/user/service/user/LoginServiceImpl.java#L244-L250 github.com: https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/views/user/info/edit.html#L81-L90 vulncheck.com: https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials
Credits
Wu Yulun