CVE-2026-100156 is listed by VU#166125: Bisheng has authentication bypass vulnerabilities.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · CERT/CC Vulnerability Notes

   Detected

   Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. T

Sources

• CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-100156

  Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated a

  kb.cert.org
• CVE.orgVulnerability recordCVE-2026-100156

  Official CVE identifier

  cve.org