CVE-2026-124505 · Package
NO FIX YET
Dianping CAT's login/logout handler trusts the rtnUrl parameter and redirects users to whatever address it contains. An attacker can send a crafted link that bounces a victim to a phishing or malicious site after login.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Dianping CAT's monitoring server with the login/logout component exposed to users. The flaw is an open redirect, so exposure depends on whether the login endpoint is reachable from the internet or from untrusted users. Deployments that do not use this version range can skip it.
Not affected if unaffected-version
Who cares dianping-cat, java, self-hosted
3.0.0, 3.1.0 or 4.0-RC1Handler.java (Login/Logout component) for the redirect function using rtnUrl without validationNo fix yet, per the sources.
A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.