Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107828Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login

Medium 6.5

In plain English

A medium-severity security flaw in jivejdon from banq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.

Affected products (as reported)

Vendor	Product	Versions
banq	jivejdon	0 – through 5.0

Weakness: CWE-1391 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Issue #28 issue-tracking
https://github.com/banq/jivejdon product
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/api/impl/account/OAuthAccountServiceImp.java#L192-L213 technical-description
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/oauth/SinaUserCallBackAction.java#L76-L80 technical-description
VulnCheck Advisory: Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login third-party-advisory