Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck
CVE-2021-4461Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass
Critical 9.3
In plain English
A critical-severity missing authentication in Zhiyuan OA Web Application System from Seeyon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Seeyon | Zhiyuan OA Web Application System | 0 – through 7.0 SP1 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg exploit
- https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml exploit
- https://github.com/projectdiscovery/nuclei-templates/blob/1ca6b8e6fe225cbd46dcb893dcaee01447afa8c0/http/misconfiguration/seeyon-unauth.yaml#L20 exploit
- https://www.vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass third-party-advisory