CVE-2026-58169: Vibe-Trading DNS rebinding authentication bypass leading to RCE
CVE-2026-58169 is verified against the affected target vulnerability class: RCE This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00254.
pruva-verify REPRO-2026-00254 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00254/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability. An unauthenticated attacker can use DNS rebinding to bypass authentication and then trigger remote code execution. Reproduce: run Vibe-Trading <0.1.10, configure a DNS rebinding setup that targets the application, send requests that bypass the authentication check, and then invoke the code-execution primitive.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.