JeecgBoot CVE-2026-8196

The vulnerability requires the mLogin endpoint to be accessible over the network and enabled in the target JeecgBoot deployment. No authentication is required to trigger the flaw (PR:N), and no user interaction is necessary (UI:N). However, the high attack complexity (AC:H) indicates that successful exploitation depends on specific conditions - likely related to the exact functional logic or state of the LoginController.java implementation that the public POC targets. These conditions are not explicitly detailed in the provided description, so defenders should examine the public POC code to identify whether exploitation requires particular request formatting, parameter values, timing windows, or other environmental factors. The vulnerability affects the login mechanism itself, suggesting that organizations with JeecgBoot instances exposed to untrusted networks face the greatest risk, while internal-only deployments may have lower real-world exposure.

This vulnerability presents conflicting exploitation signals that warrant careful interpretation. The CVSS score of 3.7 is relatively low, driven by high attack complexity (AC:H) and difficult exploitability (E:P - exploitability unproven). However, the presence of publicly available exploit code (POC:Yes) contradicts the 'difficult exploitability' rating and suggests real-world technical feasibility despite the AC:H designation. The confidentiality impact is limited (C:L), affecting only information disclosure without integrity or availability compromise. KEV status is not confirmed, so this is not yet a CISA-tracked active exploitation target, though the public POC availability increases risk for targeted attacks. The CVSS vector indicates unauthenticated network access (PR:N, UI:N), meaning any remote user can attempt exploitation without credentials. The real-world priority depends on organizational exposure to JeecgBoot instances and whether the specific functional logic exploited by the public POC is deployed in target configurations. Given the AC:H rating and limited impact scope, this is lower urgency than network-accessible RCE vulnerabilities, but organizations running JeecgBoot should monitor for exploitation attempts if exposed to untrusted networks.

An unauthenticated remote attacker crafts a specialized request to the mLogin endpoint exploiting the authorization bypass flaw in LoginController.java, allowing them to access protected resources or retrieve sensitive information without providing valid credentials. Using the publicly available POC from the GitHub repository (https://github.com/xpp3901/CVE_APPLY/tree/main/V-009_mLogin_Captcha_Bypass), the attacker can automate this attack against exposed JeecgBoot instances to enumerate or exfiltrate confidential data.