CVE-2026-129139

Description

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

References

• https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/user/service/user/LoginServiceImpl.java#L244-L250
• https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/views/user/info/edit.html#L81-L90
• https://github.com/itwanger/paicoding/issues/137
• https://vul.yulun.ac.cn/20261112/paicoding/
• https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials