A flaw in JeecgBoot up to version 3.9.2 allows attackers to craft a redirect URL that is passed to HttpServletResponse.sendRedirect without validation, enabling an open redirect (CWE‑601). An attacker could use this to lure a victim to click a malicious link, after which the browser is redirected to a site of the attacker’s choice. Although the vulnerability does not grant code execution or direct data access, it can facilitate phishing, credential harvesting, or other social‑engineering attacks.

The vulnerability exists in the Third-Party Login component of JeecgBoot, specifically within ThirdLoginController.java. All installations running JeecgBoot 3.9.2 or earlier that have the optional DingTalk, WeChat, or similar OAuth login feature enabled are affected.

The CVSS score of 2.3 reflects a low severity assessment, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exfiltration requires active engagement from the victim; attackers must generate a specially crafted OAuth link and rely on social engineering to persuade users to click. The exploit is considered difficult to execute in real world scenarios, yet public exploit code is available, so the risk is primarily through targeted phishing campaigns. The attack vector is likely remote via URL manipulation, and the attack requires attacker‑initiated user interaction.