Is there a public PoC exploit available for CVE-2026-8196?

Yes, a public proof-of-concept exploit is available for CVE-2026-8196. Prioritise patching immediately. EPSS: 0.0%.

JeecgBoot CVE-2026-8196

Q: What is the CVSS score of CVE-2026-8196?

CVE-2026-8196 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-09 VulDB

Authentication Bypass Java

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 09, 2026 - 21:22 NVD

3.7 (LOW) 2.9 (LOW)

Analysis Generated

May 09, 2026 - 21:00 vuln.today

CVE Published

May 09, 2026 - 20:15 nvd

LOW 3.7

DescriptionCVE.org

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.

Technical ContextAI

JeecgBoot is a low-code rapid development platform written in Java. The vulnerability resides in the mLogin endpoint handler within the LoginController.java component of the jeecg-module-system/jeecg-system-biz subsystem. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the login mechanism improperly validates or enforces authentication controls, allowing an attacker to bypass intended access restrictions. The attack vector is network-based (AV:N), meaning the flaw can be triggered remotely without physical access or local execution context.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to early disclosure notification per the CVE description. Organizations should immediately apply any available updates from the JeecgBoot project (check official GitHub repository https://github.com/jeecgboot/jeecg-boot for security releases). As an interim compensating control, restrict network access to the mLogin endpoint via firewall rules or Web Application Firewall (WAF) policies, limiting exposure to trusted internal networks only - this reduces attack surface but may impact legitimate remote access scenarios. Additionally, implement monitoring and logging on LoginController.java authentication attempts to detect unusual patterns that may indicate exploitation attempts. Consider disabling the mLogin feature entirely if an alternative authentication mechanism is available, though this may require application reconfiguration. Organizations should contact the JeecgBoot maintainers directly for security guidance and patch timelines, as the original vendor non-response suggests reliance on community-driven or self-patched solutions may be necessary.