Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-02 | 3 | Disclosure2Patch1 |
| 2026-07-03 | 1 | Patch1 |
🚨 CVE-2026-58466 — CVSS 9.8/10 ██████████ AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/1PyZrWLY0O
Post summary
CVE‑2026‑58466 is a critical hard‑coded default credential flaw in AutoBangumi before 3.2.8 (CVSS 9.8/10) that has an available patch.
🚨Critical - AutoBangumi Hard-Coded Default Admin Credentials (CVE-2026-58466) On startup, when its users table is empty, AutoBangumi's add_default_user() seeds a publicly known default administrator account. Since those credentials are documented/known and unchanged by default, an unauthenticated remote attacker can just submit them to the login endpoint and authenticate as admin. That grants full control of the application - RSS feed configuration, downloader configuration, and every authenticated API endpoint - with no privileges or user interaction required. Manipulating the downloader configuration is a natural pivot toward host-level impact. 👉Upgrade AutoBangumi to 3.2.8 and change any default admin credentials.
Post summary
The notice highlights a critical vulnerability in AutoBangumi involving default admin credentials that enable unauthenticated remote login, and it advises upgrading to version 3.2.8 to remediate the issue.
🚨*CVE* CVE-2026-58466 AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using t… https://www.cve.org/CVERecord?id=CVE-2026-58466 ----- Traducción: CVE-2026-58466 Aut… http://infoflow.cloud`
Post summary
The post announces CVE-2026-58466, describing it as a hard‑coded credentials vulnerability, but does not provide PoC, exploit code, or patch information.
CVE-2026-58466 AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using t… https://www.cve.org/CVERecord?id=CVE-2026-58466
Post summary
The announcement highlights a hard‑coded default credentials flaw in AutoBangumi versions before 3.2.8 that lets unauthenticated users gain admin access, but no PoC, exploit, active use, or patch details are provided.