Description
A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-24
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Open Redirect
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is a classic Open Redirect flaw in the OAuth2 client validation routine of the ruoyi-vue-pro component. An attacker can freely manipulate the redirect_uri argument in the validOAuthClientFromCache method, causing the application to redirect users to arbitrary URLs. This redirects could be used for phishing or other malicious campaigns. The weakness is classified as CWE-601.

Affected Systems

The flaw affects the ruoyi-vue-pro product from vendors YunaiV and zhijiantianya, up to the 2026.08 release. Any deployment of these components before or at that version is vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not publicly available, but the exploit has already been released to the public, and the vulnerability is not listed in the CISA KEV catalog. Remote attacks are possible by including a crafted redirect_uri in OAuth2 requests, resulting in user redirection to malicious sites. The risk is heightened if the application does not restrict the set of allowable redirect targets.

Generated by OpenCVE AI on September 25, 2026 at 05:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade ruoyi-vue-pro to a version released after 2026.08, which includes a fix for the redirect_uri validation.
  • If an immediate patch is unavailable, configure the OAuth2 client to whitelist acceptable redirect URIs and reject any redirect_uri not explicitly listed.
  • Deploy network-level filtering or a web application firewall rule to block HTTP requests containing suspicious redirect_uri parameters and prevent external redirects to untrusted domains.

Generated by OpenCVE AI on September 25, 2026 at 05:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect
First Time appeared Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
Weaknesses CWE-601
CPEs cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*
cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*
Vendors & Products Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yunaiv Ruoyi-vue-pro
Zhijiantianya Ruoyi-vue-pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-24T19:30:09.743Z

Reserved: 2026-09-24T11:34:25.729Z

Link: CVE-2026-97325

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-24T20:17:35.730

Modified: 2026-09-24T21:08:55.030

Link: CVE-2026-97325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:15:16Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')