VU#166125: Bisheng has authentication bypass vulnerabilities
Cybersecurity Classified by Officially
Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. …
This is an extract. The publication continues at the source.
Read the original at the source: https://kb.cert.org/vuls/id/166125
Officially imported this from CERT Coordination Center’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
Provenance
- Organization
- CERT Coordination Center — imported from official source
- Official source
- https://www.kb.cert.org/vuls/atomfeed/ ATOM
- Imported
- October 14, 2026 13:00
- Versions
- 1 recorded
- Identity
-
https://kb.cert.org/vuls/id/166125