Description
A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.
Published: 2026-09-03
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A logic error in the selfRegister API endpoint of HKUDS AI‑Trader allows an attacker to manipulate the initial_balance argument. This flaw is a broken business logic vulnerability (CWE‑840). By sending an inflated initial_balance, a remote user can increase the amount displayed in the equity column and skew leaderboard rankings. The underlying financial calculations remain correct, so no real monetary advantage is gained beyond a cosmetic presentation.

Affected Systems

The vulnerability affects HKUDS AI‑Trader, a continuously delivered platform with rolling releases. Because the product updates frequently and no specific release is identified, any version released before a vendor patch that addresses the logic check in routes_agent.py is potentially impacted. No explicit affected‑version list is available.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw remotely, but it requires high complexity and is considered difficult to execute. The primary impact is the ability to distort leaderboard displays, which may undermine trust and fairness in the simulated trading environment.

Generated by OpenCVE AI on September 3, 2026 at 09:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Enforce strict server‑side validation of the initial_balance parameter, restricting it to a reasonable positive range.
  • Block or remove the selfRegister endpoint for clients lacking proper authentication or authorization, ensuring only trusted parties can invoke it.
  • Deploy the most recent AI‑Trader release once the vendor publishes a fix, and verify that the patched routes_agent.py contains the input check.

Generated by OpenCVE AI on September 3, 2026 at 09:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.
Title HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
First Time appeared Hkuds
Hkuds ai-trader
Weaknesses CWE-840
CPEs cpe:2.3:a:hkuds:ai-trader:*:*:*:*:*:*:*:*
Vendors & Products Hkuds
Hkuds ai-trader
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hkuds Ai-trader
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T01:30:12.676Z

Reserved: 2026-09-02T20:07:26.182Z

Link: CVE-2026-85030

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-03T13:06:19.590

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-85030

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T09:45:03Z

Weaknesses