Executive brief
JeecgBoot, a low-code development platform, contains a security flaw in its third-party login feature (such as WeChat or DingTalk). An attacker could trick a user into clicking a malicious link that redirects them to an untrusted website. In a worst-case scenario, this could allow an attacker to capture the user's login token and gain unauthorized access to their account.
Technical details
An open redirect vulnerability exists in JeecgBoot up to version 3.9.2 within the ThirdLoginController.java component. The 'state' parameter in the OAuth2 login and callback endpoints (/sys/thirdLogin/oauth2/{source}/login and /sys/thirdLogin/oauth2/{source}/callback) is user-controlled and passed directly to HttpServletResponse.sendRedirect() without validation. A remote attacker can exploit this by inducing a user to click a specially crafted OAuth login link. Upon successful authentication, the application appends the victim's JWT token to the attacker-controlled 'state' URL and redirects the browser, allowing the attacker to capture the token and achieve account takeover. The attack requires user interaction and social engineering.
Affected products
- JeecgBoot JeecgBoot up to 3.9.2
Timeline
- 2026-05-16: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: NVD/VulDB publication date