Executive brief
OneBlog is an open-source blogging platform. A security flaw in its public-facing web module allows anyone on the internet to retrieve sensitive WeChat Official Account credentials (access tokens) without logging in. An attacker could use these credentials to impersonate the website owner on WeChat, potentially accessing private subscriber data or sending unauthorized messages.
Technical details
The OneBlog frontend module (blog-web) lacks an authentication framework, unlike the admin module which uses Apache Shiro. The endpoint '/api/jssdkGetSignature' in RestApiController.java is designed to generate signatures for WeChat JS-SDK integration but fails to implement any access control. When invoked via an unauthenticated POST request, the application retrieves the WeChat AppID and AppSecret from the database, fetches a fresh access_token and jsapi_ticket from WeChat's servers, and returns these raw credentials in the JSON response. This allows a remote attacker to bypass authentication (CWE-306) and obtain high-privilege tokens valid for 7200 seconds.
Affected products
- zhangyd-c OneBlog v2.3.9 and all earlier versions
Timeline
- 2026-07-02: disclosed: Vulnerability details shared via GitHub Gist and Issue tracker
- 2026-07-07: advisory: CVE published to NVD dataset