CVE-2026-85030 | HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df selfRegister API Endpoint routes_agent.py initial_balance logic error (Issue 241)

A vulnerability categorized as problematic has been discovered in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors.

This vulnerability is traded as CVE-2026-85030. The attack may be launched remotely. Furthermore, there is an exploit available.

This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring’s return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns – it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.VulDB Recent EntriesRead More