Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108550— SkillHub before 0.2.22 Account Takeover via Account Merge Flow

Quick assessment

Affected
iflytek skillhub
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SkillHub 在 0.2.22 版本之前，AccountMergeService 和 AccountMergeController 中存在不正确的授权漏洞，允许经过身份验证的攻击者通过滥用合并流程接管其他账户。攻击者可以调用合并发起接口，提供目标用户名或 OAuth 身份标识，直接获取验证令牌，并确认合并操作，从而继承受害者的 API 令牌、角色以及命名空间所有权。

CVSS 8.8 · High EPSS 0.30% · P21

Affected Version Matrix 1

VendorProduct Version RangeStatus
iflytek skillhub < 0.2.22 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108550

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
Source: CVE Program / CVE List V5
Vulnerability Description
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
iflytek skillhub 0 ~ 0.2.22 -

II. Public POCs for CVE-2026-108550

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108550

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-108550 (1)

Proof of Concept for CVE-2026-108550 (1)

Vendor Pages for CVE-2026-108550 (1)

Same Patch Batch · iflytek · 2026-10-10 · 3 CVEs total

CVE-2026-108548 7.3 HIGH AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
CVE-2026-108547 6.5 MEDIUM AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

IV. Related Vulnerabilities

Same vendor: iflytek
Same weakness: CWE-863

V. Comments for CVE-2026-108550

No comments yet

Leave a comment