| शीर्षक | https://github.com/jeecgboot/JeecgBoot JeecgBoot v3.9.2 Open Redirect |
|---|
| विवरण | JeecgBoot v3.9.2 contains an Open Redirect vulnerability in the OAuth2 login flow. The state parameter in /sys/thirdLogin/oauth2/{source}/login and /sys/thirdLogin/oauth2/{source}/callback is user-controlled and passed directly to HttpServletResponse.sendRedirect() without validation.
An attacker can exploit this to redirect users to arbitrary URLs. In the OAuth2 callback flow, the victim's JWT token is appended to the redirect URL, which may lead to token leakage and account takeover. |
|---|
| स्रोत | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9639 |
|---|
| उपयोगकर्ता | mukyuuhate (UID 93052) |
|---|
| सबमिशन | 22/05/2026 08:30 AM (20 दिन पहले) |
|---|
| संयम | 07/06/2026 03:48 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 369122 [JeecgBoot तक 3.9.2 Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect state] |
|---|
| अंक | 20 |
|---|