HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df selfRegister API Endpoint routes_agent.py initial_balance logic error

Summaryinfo

A vulnerability identified as problematic has been detected in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The impacted element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Performing a manipulation of the argument initial_balance results in logic error. This vulnerability is known as CVE-2026-85030. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

Detailsinfo

A vulnerability classified as problematic has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. This affects some unknown functionality of the file service/server/routes_agent.py of the component selfRegister API Endpoint. The manipulation of the argument initial_balance with an unknown input leads to a logic error vulnerability. CWE is classifying the issue as CWE-840. This is going to have an impact on integrity.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-85030. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• HKUDS

Name

• AI-Trader

Version

• d03ff6c056b32ced735adf7c19ed8175adb1c8df

Website

• Product: https://github.com/HKUDS/AI-Trader/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #830272: HKUDS AI-Trader 1.0 Business Logic Errors (by davidgilmore)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion