EUVD-2026-35037
GHSA-2r69-34r8-6c68
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdLoginController.java of the component Third-Party Login. This manipulation of the argument state causes open redirect. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The project replied: "After evaluation, this vulnerability has low exploitability in real-world scenarios: 1) Exploiting this vulnerability requires attackers to use social engineering techniques to induce victims to actively click on an OAuth login link constructed by the attacker; it cannot be triggered passively. 2) Third-party login (DingTalk/WeChat, etc.) is an optional feature and may not be enabled in most projects."
AnalysisAI
Open redirect in JeecgBoot's ThirdLoginController (versions 3.9.0-3.9.2) allows remote attackers to manipulate the OAuth state parameter and redirect victims to attacker-controlled URLs via the third-party login flow. The vendor's own assessment confirms low real-world exploitability: successful exploitation requires social engineering to induce victims into clicking a crafted OAuth login link, and the affected third-party login feature (DingTalk, WeChat) is optional and likely disabled in most deployments. Publicly available exploit code exists, but no KEV listing indicates active exploitation campaigns at time of analysis.
Technical ContextAI
JeecgBoot is a Java-based low-code development platform. The vulnerability resides in ThirdLoginController.java within the jeecg-module-system/jeecg-system-biz module, specifically in the HttpServletResponse.sendRedirect function. CWE-601 (URL Redirection to Untrusted Site) occurs when application logic accepts user-controlled input specifying an external URL and passes it directly to an HTTP redirect without allowlist validation. In this case, the OAuth state parameter - used in flows for DingTalk, WeChat, and similar third-party identity providers - is not sanitized before being consumed by sendRedirect, enabling an attacker to craft a login URL whose post-authentication redirect points to an arbitrary external destination. The CPE identifier cpe:2.3:a:n/a:jeecgboot:*:*:*:*:*:* confirms this is a JeecgBoot application-layer issue, not a dependency or framework flaw.
RemediationAI
No vendor-released patched version is confirmed from available data - the GitHub issue at https://github.com/jeecgboot/JeecgBoot/issues/9639 documents vendor acknowledgment and response, but no tagged release with a fix has been referenced in the provided intelligence. Monitor that issue and the VulDB entry at https://vuldb.com/cve/CVE-2026-11502 for patch release announcements. As the primary compensating control, disable the third-party login feature (DingTalk, WeChat, etc.) if it is not actively required - the vendor confirms this module is optional, and disabling it eliminates the attack surface entirely with no impact to core platform functionality. If third-party login must remain active, implement server-side allowlist validation for the OAuth state and redirect_uri parameters, rejecting any values that do not match a pre-approved list of internal application URLs; note this requires a code-level or WAF-level fix and cannot be addressed through configuration alone. Deploy WAF rules to detect and block open redirect patterns in OAuth callback parameters as an additional detection layer.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today