Vulnerability · Published Jun 24, 2025 · Assigned by VulDB

CVE-2025-6552java-aodeng Hope-Boot Login WebController.java doLogin redirect

Medium 4.3

In plain English

A medium-severity open redirect in Hope-Boot from java-aodeng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 63.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
java-aodeng	Hope-Boot	1.0.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-313692 | java-aodeng Hope-Boot Login WebController.java doLogin redirect vdb-entry, technical-description
VDB-313692 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #596681 | java-aodeng hope-boot 1.0.0-release Open Redirect third-party-advisory
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md exploit
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md#steps-to-reproduce exploit