CVE-2026-45672: The Seller Did Not Need a Deadline

The repository contains no exploit code

A git clone of CryptReaper12/CVE-2026-45672 returns one tracked file, README.md. The repository's history is two commits, two minutes and seventeen seconds apart:

2af886b CryptReaper12 2026-05-16 05:39:02 +0300  README.md
18c8a78 CryptReaper12 2026-05-16 05:36:45 +0300  Initial commit

There is no exploit.py. There is no requirements.txt. There is no .py of any name. The README's Usage section references exploit.py and requirements.txt by name. Neither file exists in the tree. The README's final line is a link:

### PoC Exploit - [href](https://tinyurl.com/5e3mybn8)

tinyurl.com/5e3mybn8 returns a 301 to https://satoshidisk.com/pay/CRP2iq.

SatoshiDisk is a Bitcoin payment platform whose listings sell digital files for cryptocurrency. The listing terms are the same terms the Cisco paywall PoC sat behind on May 15: the platform "cannot verify uploaded content," is "not responsible for the content," "cannot provide refunds." All sales are final. The buyer pays in Bitcoin. The buyer receives whatever bytes the seller uploaded, at some point before the buyer existed, into a single-use listing. The Bitcoin transaction does not support chargebacks. The seller's wallet rotates on every listing.

The repository is a storefront. The README is sales copy. The git history is the storefront's facade.

The README was typed for a different product

The Open WebUI CVE is a code-execution feature-gate bypass. The vulnerable parameter is the code field in the JSON body of a POST to /api/v1/utils/code/execute. The vulnerable function calls into a Jupyter backend. The product is a Python web application that runs offline on Linux containers, Docker, and self-hosted GPU machines.

The README's Options section reads as follows:

- `--target`: URL of the vulnerable CentreStack/TrioFox instance.
- `--file`: Relative path to the file to include (e.g., "../../../../Windows/system.ini" for testing).
- `--proxy`: Optional HTTP proxy for anonymization.

CentreStack and TrioFox are Gladinet products, an enterprise file-server and cloud-storage gateway running on Windows IIS. Their disclosed vulnerabilities are typically arbitrary file include, path traversal, and .NET viewstate deserialization. A --file parameter taking a relative Windows path with a Web.config example describes a CentreStack arbitrary file read, not an Open WebUI code execution.

The contradiction is visible in twenty seconds of reading. A defender skimming for a verification PoC sees "Open WebUI" at the top, "PoC Exploit" at the bottom, and a paid link. The middle is filler the eye scrolls past. The seller's three-paragraph wedge between the title and the link is dense enough to read as detailed and shallow enough to be a copy-paste. Both readings serve the seller. The detailed reading converts the skim into a transaction. The shallow reading is what allowed the seller to ship without producing the wrong-product flag in their own quality check.

The seller did not catch the residue. The CentreStack stanza appears verbatim in five of CryptReaper12's six repositories. The seller has a template. The template has not been updated for any of them.

The author has six repositories. None of them contain code.

CryptReaper12 was created on May 6, 2026. As of May 16, the account has six repositories, all CVE-named, all created within minutes of being pushed:

CVE-2026-0073    2026-05-06   Android Wireless ADB authentication
CVE-2026-7411    2026-05-06   Eclipse BaSyx Java Server SDK path traversal
CVE-2026-33324   2026-05-06   SQLBot prompt injection
CVE-2026-44109   2026-05-07   OpenClaw Feishu webhook bypass
CVE-2026-8260    2026-05-11   D-Link DCS-935L buffer overflow
CVE-2026-45672   2026-05-16   Open WebUI code execution

Six different products. Five different vulnerability classes. The catalog spans embedded camera firmware, Java server SDKs, mobile OS internals, business-intelligence tooling, AI orchestration, and a Lua game engine. The author has no plausible expertise in any of these areas. The author has a template and a publication pipeline.

The pipeline is fast. CVE-2026-45672 was published on NVD at 21:16 UTC on May 15. The repository was created at 02:36 UTC on May 16. Five hours and twenty minutes from disclosure to storefront. CVE-2026-44109 was published on May 6 and the repository was created on May 7. The other four were created on or within a day of their NVD publication date. The seller is monitoring NVD's RSS feed or a derivative. The template fields render in the time it takes to type the CVE number and paste an NVD blurb.

The README's typography is consistent across all six. The structure is consistent across all six. The TinyURL placement is consistent across all six. The CentreStack/TrioFox stanza appears in five. The remaining two (OpenClaw, D-Link) use a second template that says python exploit.py -h 10.10.10.10 -c 'uname -a' and links to a different TinyURL. Both TinyURLs resolve to satoshidisk.com. The seller runs two templates.

The repositories have zero stars between them. They are not surfaced by GitHub's trending feed. They are surfaced by the CVE-number search bar. A defender who types CVE-2026-45672 into GitHub's search box, today, sees this repository at position one of one. The visibility is structural, not earned.

Four of the READMEs spell exploit with a Cyrillic small o

The word "exploit" appears at least three times in each README. In CVE-2026-0073, CVE-2026-7411, CVE-2026-33324, and CVE-2026-44109, the o in exploit is U+043E, the Cyrillic small letter o. The Latin o is U+006F. The two characters render identically in every font defenders use:

$ od -An -c README.md | grep -E '320 276' | head -2
   e   x   p   l 320 276   i   t   :       `   p   y   t   h   o
   n       e   x   p   l 320 276   i   t   .   p   y       -   -

320 276 is the UTF-8 byte sequence for U+043E. The bytes the file system stores are e, x, p, l, then a Cyrillic о, then i, t. The browser renders explоit. A reader sees exploit.

The substitution is not accidental. Inserting U+043E requires either a deliberate paste from a charmap source or a script that does the swap. It survives English-language rendering, lexical normalization in most automated pipelines, and a hand-written grep -i exploit. A scanner that filters GitHub for repositories whose README contains the literal word "exploit" misses four of these six. A fuzzy match against expl?it misses them too. The Latin-character exploit only appears in this one (Open WebUI) and the D-Link repo, the two repositories using the second template.

The seller has classified their own catalog into "templates that hide from the grep" and "templates that do not." The Open WebUI README sits in the second pile. This post would otherwise not have noticed the detail. The detail is the catalog's, not this CVE's.

CISA's deadline was the marketing budget. CryptReaper12 has no such budget.

On May 15, we covered a paywall PoC for CVE-2026-20182 published by an account named fangbarristerbar. The seller's framing was specific to that CVE: Cisco Catalyst SD-WAN, CVSS 10.0, CISA KEV inclusion with a 48-hour federal civilian remediation deadline of May 17. We named the pattern Paywall PoC. The post's closing line was: the seller does not need a working exploit; the seller needs a deadline.

fangbarristerbar did need a deadline. The Bangkok account, on its third week, published one repository tied to one KEV entry. The 48-hour federal-civilian clock converted skimming defenders into transacting buyers. The seller's storefront went up at 14:07 UTC on May 15 because that was the moment defender Twitter started linking the Cisco advisory to the KEV pressure. The buyer population was at its peak and at its time-poorest.

CryptReaper12 does not need a deadline. CVE-2026-45672 has a CVSS of 8.8. It is not on KEV. There is no federal remediation timeline. There is no public in-wild exploitation reporting. The advisory points only to a GitHub Security Advisories page, the kind of advisory the Open WebUI maintainer publishes alongside the patch release because the project's release process generates one as a byproduct. The defender searching for this CVE today is doing it because their software-composition analyzer flagged open-webui<0.8.12 in an internal registry. The defender is doing it on their own schedule. There is no clock.

The seller does not care that there is no clock. Five hours and twenty minutes after the CVE appeared on NVD, the storefront went up. The same template that wrapped the D-Link buffer overflow and the Eclipse BaSyx path traversal and the Android ADB authentication flaw, with field substitutions, was good enough for this one too. The seller's catalog covers six products that share no codebase, no vendor, no severity tier, and no CVE class. The unifying thread is that each CVE has an NVD entry and a number a defender will type into GitHub's search bar.

fangbarristerbar's operation was opportunism. A KEV deadline appeared; a storefront appeared underneath it. CryptReaper12's operation is supply. Every CVE that NVD publishes with a CVSS above some internal floor receives a storefront. The deadline-arbitrage variant of the Paywall PoC is one operator's lane. The supply variant is another's. Both run the same playbook against the same defender population through the same payment rail.

The bug is real. The patch is six lines.

The CVE itself is correct. Open WebUI 0.8.11 and earlier register two routes under /api/v1/utils/code/:

@router.post('/code/format')
async def format_code(form_data: CodeForm, user=Depends(get_admin_user)):
    ...

@router.post('/code/execute')
async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_verified_user)):
    if request.app.state.config.CODE_EXECUTION_ENGINE == 'jupyter':
        output = await execute_code_jupyter(...)

The cosmetic endpoint, /code/format, requires admin. The endpoint that runs arbitrary Python on the Jupyter backend, /code/execute, requires only a verified user, any logged-in account. The function reads CODE_EXECUTION_ENGINE to pick the backend. The function does not read ENABLE_CODE_EXECUTION. The admin's toggle was wired to admin UI state. The endpoint's behaviour was wired to the engine selector. The flag had the API surface of an enforced control and the runtime behaviour of an unread variable.

The patch in v0.8.12 adds six lines at the top of execute_code:

 @router.post('/code/execute')
 async def execute_code(request: Request, form_data: CodeForm, user=Depends(get_verified_user)):
+    if not request.app.state.config.ENABLE_CODE_EXECUTION:
+        raise HTTPException(
+            status_code=403,
+            detail=ERROR_MESSAGES.FEATURE_DISABLED('Code execution'),
+        )
+
     if request.app.state.config.CODE_EXECUTION_ENGINE == 'jupyter':

A working exploit against the unpatched endpoint is a single curl from any account the operator can verify by email:

curl -X POST https://victim.local/api/v1/utils/code/execute \
     -H "Authorization: Bearer $VERIFIED_USER_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"code": "import os; os.system(\"id > /tmp/pwn\")"}'

Four lines of curl against any Open WebUI 0.8.11 instance whose admin set ENABLE_CODE_EXECUTION=false and trusted the setting. This is the artifact CryptReaper12 is renting access to. The fact that the actual primitive is four lines of curl is the reason the seller can ship a wrong-product README and still expect transactions. The buyer does not need a sophisticated exploit. The buyer needs to believe, at the moment of payment, that anything substantive is behind the link.

The seller does not need to be substantive. The seller needs to be there.

PoC: CryptReaper12/CVE-2026-45672