VU#166125: Bisheng has authentication bypass vulnerabilities
概要
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or syst...
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or systems recognize that content or interactions come from an AI assistant rather than a human. Impact Authentication Bypass / Account Takeover: The legacy SSO vulnerability (
(CERT/CC Vulnerability Notes: VU#166125: Bisheng has authentication bypass vulnerabilities)
出典: CERT/CC Vulnerability Notes NVD
参照URL
- CERTCC-VULNOTES VU#166125: Bisheng has authentication bypass vulnerabilities