Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121938langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in langchain4j-aideepin from moyangzhan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.

Affected products (as reported)

Vendor	Product	Versions
moyangzhan	langchain4j-aideepin	0 – before 3.31.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/moyangzhan/langchain4j-aideepin/issues/116 issue-tracking
https://hackmd.io/@hieuPenguinnn/langchain4j-aideepin-character-conversation-cross-user-idor third-party-advisory
https://github.com/moyangzhan/langchain4j-aideepin/pull/117 issue-tracking, patch
https://github.com/moyangzhan/langchain4j-aideepin/commit/9b2fee6b66836a0efd5599cfcddd05b80b05ca93 patch
https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.30.0/server/adi-common/src/main/java/com/moyz/adi/common/service/CharacterService.java#L105-L125 technical-description
VulnCheck Advisory: langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid} third-party-advisory
https://hackmd.io/@hieuPenguinnn/cve-2026-121938-langchain4j-aideepin-character-conversation-cross-user-idor exploit