The vulnerability lies in the JeecgBoot 3.9.1 mLogin Endpoint within LoginController.java, permitting an attacker to bypass normal authorization checks. This flaw allows unauthorized access to protected resources, potentially exposing sensitive data or enabling further privileged actions. The issue is an authorization weakness classified as CWE‑285 and an authorization logic failure, CWE‑639.

JeecgBoot applications running version 3.9.1 are affected. The flaw is located in the module jeecg-module-system/jeecg-system-biz within the LoginController.

The score of 6.3 on the CVSS scale indicates moderate severity. The lack of an EPSS value suggests no publicly known exploit prevalence yet, although the vulnerability is exploitable remotely with high complexity. The CVE is not listed in the CISA KEV catalog. An attacker would need to access the mLogin Endpoint, craft a request that manipulates the authorization logic, and obtain unauthorized privileges.