CVE-2026-58466: AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()

Synopsis

Hard-coded default credentials in AutoBangumi before version 3.2.8 allow an unauthenticated attacker to log in as administrator using publicly known credentials seeded at startup by the add_default_user() function when the users table is empty. The vulnerability is reachable over the network with no authentication required, and successful exploitation gives an attacker full administrative control of the application, including RSS feed configuration, downloader settings, and all authenticated API endpoints. A patched-image rebuild at version 3.2.8 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the AutoBangumi authentication endpoint over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed prior to exploitation; the attacker supplies the publicly known default credentials seeded by add_default_user() to authenticate as administrator.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the affected instance.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free, requiring only submission of the known default credentials to the login endpoint.

Blast Radius

• Attacker gains full administrative access and reads all application configuration, including RSS feed sources and downloader credentials stored in the application.
• Attacker modifies RSS feed and downloader configuration, redirecting media acquisition or injecting malicious feed sources.
• Attacker calls any authenticated API endpoint, enabling arbitrary changes to application state and user management.
• Attacker can disrupt the service by altering or deleting configuration, causing the downloader and feed processing pipeline to fail.