RuoYi‑Vue‑Plus versions up to 6.0.0 contain an IDOR that permits any authenticated user to delete another user’s social login binding by supplying a target socialId. This deletion removes the associated OAuth token, preventing the victim from logging in via that social provider. The weakness is a classic Direct Object Reference flaw (CWE‑639) that undermines the confidentiality of the victim’s access credentials.

The vulnerability affects the dromara RuoYi‑Vue‑Plus application, specifically any installation running version 6.0.0 or earlier. The exposed endpoint is DELETE /auth/unlock/{socialId}.

The CVSS score of 2.3 indicates low severity, and no EPSS score is available to suggest current exploitation activity. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. Attackers need only authenticated access and knowledge of a target’s socialId, which makes the vector relatively easy for users with access to social login data. Despite the low severity score, the ability to deny a user social‑login access can be disruptive to business operations.