Description
Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.
Severity (CVSS)
| Base score | 7.7 |
|---|---|
| Severity | High |
| Version | CVSS 4.0 |
| Vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Provided by | CNA |
Weaknesses
- CWE-346 — Origin Validation Error
Affected products
| Vendor | Product | Versions |
|---|---|---|
| HKUDS | Vibe-Trading | 0 to <0.1.10 |
References
- https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10 (release-notes)
- https://github.com/HKUDS/Vibe-Trading/pull/243 (patch)
- https://github.com/HKUDS/Vibe-Trading/pull/242 (patch)
- https://github.com/HKUDS/Vibe-Trading/pull/245 (patch)
- https://github.com/HKUDS/Vibe-Trading/pull/241 (patch)
- https://github.com/HKUDS/Vibe-Trading/pull/293 (patch)
- https://www.vulncheck.com/advisories/vibe-trading-loopback-trust-and-missing-host-validation-enable-dns-rebinding-authentication-bypass-and-remote-code-execution (third-party-advisory)
Generated from the official CVE List on 01 Jul 2026 07:05 UTC.