CVE-2026-58466 (CVSS 9.8)

Description

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.

Is your site exposed to CVE-2026-58466?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0051

Probability of exploitation

0.40%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-1392 CWE-1392

References

Other References

https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73 https://github.com/EstrellaXD/Auto_Bangumi/issues/1041 https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8 https://www.vulncheck.com/advisories/autobangumi-hard-coded-default-credentials-via-add-default-user

Frequently Asked Questions

What is CVE-2026-58466? +

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-58466? +

CVE-2026-58466 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0051, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-58466? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-76155

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative …

CVE-2024-5632

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with …

CVE-2026-77056

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are …

CVE-2026-90451

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis …

CVE-2026-90456

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies …

CVE-2026-100103

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An …

CVE-2026-58466