La fiche CVE officielle n’est pas encore publiée
Publié d’après l’avis de l’éditeur. Remplacé par la fiche CVE.org / NVD dès sa publication.
VU#166125: Bisheng has authentication bypass vulnerabilities
Résumé
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or syst...
Description d'origine La description telle que publiée par la source (souvent en anglais).
CVE-2026-100156 (Credential Abuse & Access Control Skip) Within the assistant service's prompt auto-optimization feature, endpoints accept an assistant identifier from the caller without verifying whether the caller owned that assistant. An assistant identifier is a mechanism that lets users or systems recognize that content or interactions come from an AI assistant rather than a human. Impact Authentication Bypass / Account Takeover: The legacy SSO vulnerability (
(CERT/CC Vulnerability Notes: VU#166125: Bisheng has authentication bypass vulnerabilities)
Source: CERT/CC Vulnerability Notes NVD
Références
- CERTCC-VULNOTES VU#166125: Bisheng has authentication bypass vulnerabilities