The vulnerability in Jivejdon up to version 5.0 allows an attacker to derive a predictable password from a victim’s public Weibo user ID. By using the first four digits of the ID, the attacker can log in to the application through the normal credential form and read or post content as the victim, effectively bypassing any authentication controls that should restrict user activity.

The issue affects the open‑source Jivejdon application from the vendor banq. Any deployment of Jivejdon version 5.0 or earlier is susceptible because the OAuthAccountServiceImp implementation sets a hard‑coded four‑digit password derived from the Weibo ID. Upgrades to newer major releases are expected to remove this behaviour.

The CVSS score of 6.9 indicates a moderate risk level. The EPSS score is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based, requiring only a public Weibo ID and access to the site’s login page. The flaw is straightforward to exploit once the attacker obtains a public ID, allowing them to assume the victim’s identity within the Jivejdon system.