The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
VU#166125: Bisheng has authentication bypass vulnerabilities
Summary
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or syst...
Original description The description as published by the source.
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or systems recognize that content or interactions come from an AI assistant rather than a human. Impact Authentication Bypass / Account Takeover: The legacy SSO vulnerability (
(CERT/CC Vulnerability Notes: VU#166125: Bisheng has authentication bypass vulnerabilities)
Source: CERT/CC Vulnerability Notes NVD
References
- CERTCC-VULNOTES VU#166125: Bisheng has authentication bypass vulnerabilities