CVE-2026-85030
Received Received - Intake

Business Logic Error in HKUDS AI-Trader via initial_balance Manipulation

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85030
EUVD
EUVD-2026-70311

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hkuds ai-trader to d03ff6c056b32ced735adf7c19ed8175adb1c8df (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-840 Business Logic Errors

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in HKUDS AI-Trader up to a specific commit. It involves the selfRegister API endpoint in the file service/server/routes_agent.py. The issue occurs when the initial_balance argument is manipulated, leading to business logic errors. The attack is remote, complex, and difficult to exploit but has been publicly disclosed.

Impact Analysis

The impact is limited to cosmetic and leaderboard-gaming concerns in a simulated game. Inflating initial_balance does not create artificial percentage returns but only inflates absolute cash or equity values. This affects leaderboard rankings but not core functionality or financial outcomes.

Mitigation Strategies

Implement input validation for the initial_balance parameter in the selfRegister API endpoint to prevent business logic errors. Monitor API logs for unusual activity related to balance manipulation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart