CVE-2026-58466: AutoBangumi before 3.2.8 seeds a default admin account on empty databases, allowing unauthenticated users to log in with publicly known default credentials and gain full control. (REPRO-2026-00219)

Pruva

Verified — AutoBangumi before 3.2.8 seeds a default admin account on empty databases, allowing unauthenticated users to log in with publicly known default credentials and gain full control.

REPRO-2026-00219 EstrellaXD/Auto_Bangumi · standalone application (Python/FastAPI) Jul 3, 2026 .txt

Severity CRITICAL

Confidence HIGH

Reproduced in 14m 56s

Tool calls 128

Spend $2.02

Affected < 3.2.8

Fixed in 3.2.8

01 · Reproduce

Download script Open in Codespaces → Variant script

$ pruva-verify REPRO-2026-00219

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00219/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

02 · The vulnerability

AutoBangumi versions prior to 3.2.8 create a default administrator account when the users table is empty. The credentials are hard-coded and publicly known, enabling unauthenticated attackers to log in via the authentication endpoint and obtain full administrative access to the application.

03 · Root cause

Variant analysis

04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/ticket.md2.1 KB

bundle/ticket.json3.0 KB

bundle/logs/pull-vuln.log0.2 KB

bundle/logs/pull-fixed.log0.2 KB

bundle/logs/run.log16.4 KB

bundle/logs/vuln-1-startup.log2.0 KB

bundle/logs/vuln-2-startup.log2.0 KB

bundle/logs/fixed-1-startup.log2.0 KB

bundle/logs/fixed-2-startup.log2.0 KB