# CVE-2026-124505: Dianping CAT open redirect in login handler

Source: https://junglewise.ai/threats/cve-2026-124505-a-flaw-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0-rc1-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124505 · Severity: medium · CVSS 4.3 · Published 2026-11-09

Dianping CAT is an application performance monitoring and log analysis platform. A flaw in the login/logout handler allows attackers to manipulate redirect URLs, potentially redirecting users to malicious websites after they attempt to log in. This could be exploited for phishing attacks or credential theft.

Technologies: [Dianping CAT](https://junglewise.ai/threats/technologies/cat). Vendors: [Dianping](https://junglewise.ai/threats/vendors/dianping).

## Quick answers

**Is CVE-2026-124505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124505 being exploited in the wild.

**How severe is CVE-2026-124505?** Medium severity, with a CVSS score of 4.3, published 9 November 2026.

**Which products and versions are affected?** Dianping CAT 3.0.0, 3.1.0, 4.0-RC1.

**Is there a fix for CVE-2026-124505?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124505?** Check whether you run Dianping CAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability exists in the Handler.redirect function of Handler.java in the Login/Logout component. The rtnUrl parameter is not properly validated, allowing remote attackers to craft malicious URLs that redirect users to arbitrary sites. No authentication is required to exploit this vulnerability.

## Affected products

- Dianping CAT 3.0.0, 3.1.0, 4.0-RC1

## Timeline

- 2026-11-09: disclosed

## References

- [https://vuldb.com/cve/CVE-2026-124505](https://vuldb.com/cve/CVE-2026-124505)
- [https://vuldb.com/submit/1035480](https://vuldb.com/submit/1035480)

## Related threats

- [Dianping CAT cross-site scripting in report handler](https://junglewise.ai/threats/cve-2026-124506-a-vulnerability-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0)
- [Dianping CAT session cookie forgery via weak hash integrity check](https://junglewise.ai/threats/cve-2026-85181-dianping-cat-session-cookie-forgery-via-weak-hash-integrity-check)