Vulnerability · Published Sep 24, 2026 · Assigned by VulDB

CVE-2026-97325YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect

Medium 4.3

In plain English

A medium-severity open redirect in ruoyi-vue-pro from YunaiV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
YunaiV	ruoyi-vue-pro	2026.08
zhijiantianya	ruoyi-vue-pro	2026.08

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-409333 | YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect vdb-entry, technical-description
VDB-409333 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-97325 | CVE Analysis and Report third-party-advisory
Submit #908276 | zhijiantianya ruoyi-vue-pro 2026.06 重定向 third-party-advisory