Dianping CAT CVE-2026-124505

Exploitation requires an attacker to supply a crafted value to the rtnUrl argument of the Login/Logout Handler.redirect function and to induce a victim to follow that link (UI:P, passive user interaction) to a running Dianping CAT instance (versions 3.0.0, 3.1.0, or 4.0-RC1). No authentication or special privileges are needed on the attacker side (PR:N), and no non-default configuration is indicated. What limits exploitation: success depends on social engineering the victim into clicking, and impact is restricted to redirection with low integrity impact only (no confidentiality or availability loss and no server-side code execution), so the practical harm is phishing and trust abuse rather than direct compromise of the CAT server.

This is a moderate-severity open redirect (CWE-601) in the Login/Logout Handler.redirect function of Dianping CAT, driven by an attacker-controlled rtnUrl parameter. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, score 5.3) describes a remotely reachable, low-complexity flaw with no privileges required but passive user interaction (UI:P) - a victim must follow a crafted link. Impact is confined to low integrity (VI:L) with no confidentiality or availability effect, which is consistent with an open redirect used for phishing/trust abuse rather than direct code execution or data theft. Signals are mixed: the description states an exploit has been published and the vector carries E:P (proof-of-concept maturity), yet there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real but non-urgent priority. Net assessment: a genuine issue worth scheduled remediation, but not a high-real-risk, drop-everything flaw - its reliance on user interaction and its integrity-only, redirect-only impact cap the real-world danger. Note that no fixed version exists: the vendor was contacted but did not respond, so defenders must rely on mitigations rather than a patch.

An attacker crafts a link to the CAT Login/Logout endpoint with the rtnUrl parameter set to an attacker-controlled site, then sends it to a victim via email or chat. Because the hostname and path belong to the trusted CAT instance, the victim trusts the link, authenticates, and is silently redirected to the malicious destination for credential phishing or token theft. A public PoC reference exists (the advisory states the exploit has been published) but it is not verified as working exploit code; the low attack complexity and lack of required privileges make abuse straightforward once a victim clicks.