CVE-2026-11502: JeecgBoot Open Redirect in Third-Party Login – Security Analysis

Technical summary

The vulnerability exists in the ThirdLoginController.java component, specifically in the HttpServletResponse.sendRedirect function call. The state parameter used in OAuth authentication flows is not properly validated before being passed to the redirect method, allowing CWE-601 (URL Redirection to Untrusted Site) exploitation. While a proof-of-concept has been disclosed publicly, real-world impact is constrained by two factors: the attack vector requires user interaction (clicking an attacker-controlled OAuth link), and third-party login is an optional feature that may not be enabled in many JeecgBoot installations.

Business impact

Organizations running JeecgBoot with third-party login enabled face credential phishing risk. An attacker could craft a legitimate-looking OAuth login link that, after the user authenticates, redirects them to a credential harvesting site or malicious domain. This is a secondary attack that follows successful social engineering rather than a direct system compromise. The impact is typically reputation damage and user credential exposure rather than direct data breach of the JeecgBoot system itself.

Affected systems

JeecgBoot versions 3.9.2 and earlier are affected. The vulnerability only manifests if third-party login functionality (such as DingTalk or WeChat integration) has been configured and enabled. Default or minimal installations without third-party OAuth integration are not exposed.

Exploitability

The CVSS 3.1 score of 3.1 (LOW) reflects the genuine barriers to exploitation. An attacker must construct a weaponized OAuth login URL and use social engineering to convince a target user to click it. The attack cannot be triggered passively through network reconnaissance or exploit delivery. The project's assessment is accurate: this requires both attacker sophistication and victim cooperation. Public disclosure of a PoC increases theoretical risk but does not fundamentally change the practical difficulty.

Remediation

Upgrade JeecgBoot to a version above 3.9.2 that includes patching of the state parameter validation in ThirdLoginController.java. Organizations unable to upgrade immediately should consider disabling third-party login functionality if not operationally critical, or implement reverse-proxy-level URL filtering to block malformed redirect parameters as a temporary control.

Patch guidance

Consult the JeecgBoot project repository and security advisories for patched versions released after June 2026. Verify that the patch includes input validation and/or allowlisting of redirect destinations in the third-party login flow. Test the patch in a pre-production environment to confirm third-party login functionality remains intact before rolling out to production systems.

Detection guidance

Monitor HTTP logs and reverse-proxy records for ThirdLoginController requests with unusual or suspicious state parameter values, particularly those containing external domains or URL-encoded redirect targets. Implement endpoint monitoring on servers with third-party OAuth enabled to flag redirect calls with non-whitelisted destinations. User education on recognizing phishing and unusual post-login redirects is also valuable.

Why prioritize this

This vulnerability warrants attention but is not critical. The LOW CVSS score, optional nature of the affected feature, and social engineering requirement place it in the medium-term patching queue rather than emergency response. Prioritize it higher if your JeecgBoot deployment actively uses third-party login with external trust, or if you operate in an environment with high social engineering risk (e.g., highly targeted organizations).

Risk score, explained

The CVSS 3.1 score of 3.1 correctly reflects low severity: network-accessible but requires high attack complexity, no privilege elevation, and only results in integrity loss (credential theft via redirect), not confidentiality or availability impact. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N appropriately penalizes the high complexity and user interaction requirement. The public PoC increases likelihood but does not change the underlying difficulty or impact ceiling.

Frequently asked questions