The /send-message endpoint in xianyu-auto-reply-fix prior to version 2.0.7 contains a missing authorization check. An attacker who knows the hard‑coded api_key associated with the application and the cookie_id of a merchant account can submit a POST request to /send-message, specifying a target user id and arbitrary message. This allows the attacker to send crafted Xianyu messages that appear to come from a legitimate merchant, facilitating phishing, fraud, or misinformation attacks. The weakness is a lack of user authentication and input validation, indexed as CWE‑1188.

The affected product is GuDong2003's xianyu-auto-reply-fix, with all releases up to and including version 2.0.7 vulnerable. The vulnerability relies on default API secrets that are publicly documented in the project's source code and release notes.

The vulnerability has a CVSS score of 6.3, indicating moderate severity. EPSS data is not available, and the issue is not currently listed in the CISA KEV catalog. The attack requires knowledge of the default api_key and a cookie_id that can be discovered via the public repository or by observing network traffic. Once these credentials are known, an attacker can exploit the endpoint remotely over the network by sending a crafted HTTP POST request. The lack of authentication makes deployment straightforward for those with the credentials, but no additional privileges are required beyond those credentials.