{"id":"CVE-2026-124505","kind":"vulnerability","aliases":["CVE-2026-124505"],"related":[],"title":"Dianping CAT: login redirect parameter allows open redirect to attacker sites","description":"A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Dianping CAT's login/logout handler trusts the rtnUrl parameter and redirects users to whatever address it contains. An attacker can send a crafted link that bounces a victim to a phishing or malicious site after login.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dianping-cat","java","package","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check whether the deployment runs Dianping CAT versions `3.0.0`, `3.1.0` or `4.0-RC1`\n- Look in `Handler.java` (Login/Logout component) for the `redirect` function using `rtnUrl` without validation","fix":null,"status":"open","published_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","triaged_at":"2026-11-09T01:25:36+00:00","updated_at":"2026-11-09T01:25:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T01:25:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dianping CAT: login redirect parameter allows open redirect to attacker sites","impact":"low","summary":"Dianping CAT's login/logout handler trusts the rtnUrl parameter and redirects users to whatever address it contains. An attacker can send a crafted link that bounces a victim to a phishing or malicious site after login.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dianping-cat","self-hosted","java"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"users are redirected to attacker-controlled phishing sites","analyst_note":"Confirm whether any fixed version of Dianping CAT exists and whether the vendor published a patch; the sources say the vendor did not respond.","how_to_check":"- Check whether the deployment runs Dianping CAT versions `3.0.0`, `3.1.0` or `4.0-RC1`\n- Look in `Handler.java` (Login/Logout component) for the `redirect` function using `rtnUrl` without validation\n- unknown whether a fixed version exists","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running Dianping CAT's monitoring server with the login/logout component exposed to users. The flaw is an open redirect, so exposure depends on whether the login endpoint is reachable from the internet or from untrusted users. Deployments that do not use this version range can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4591,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124505':14A,17A '-2026':13A,16A '/3.1.0/4.0-rc1':71C '3.0.0':70C 'address':40B 'affect':73C 'allow':6A 'argument':90C 'attack':10A,44B,98C 'bounc':51B 'cat':2A,20B,27B,69C 'compon':83C 'contact':116C 'contain':42B 'craft':48B 'cve':12A,15A 'dianp':1A,19B,26B,68C 'dianping-cat':18B 'disclosur':120C 'earli':117C 'execut':85C 'exploit':105C 'file':79C 'flaw':63C 'found':66C 'function':75C 'handler':30B 'handler.java':80C 'handler.redirect':76C 'host':25B 'java':21B 'lead':93C 'link':49B 'login':3A,61B 'login/logout':29B,84C 'malici':58B 'manipul':87C 'may':99C,110C 'open':7A,95C 'packag':22B 'paramet':5A,34B 'perform':101C 'phish':56B 'publish':108C 'redirect':4A,8A,36B,96C 'remot':103C 'respond':124C 'rtnurl':33B,91C 'self':24B 'self-host':23B 'send':46B 'site':11A,59B 'trust':31B 'use':112C 'user':37B 'vendor':114C 'victim':53B 'way':127C 'whatev':39B","nicknames":[],"mitigations":[],"who_affected":"Teams running Dianping CAT's monitoring server with the login/logout component exposed to users. The flaw is an open redirect, so exposure depends on whether the login endpoint is reachable from the internet or from untrusted users. Deployments that do not use this version range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dianpingcat","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124505':14A,17A '-2026':13A,16A 'allow':6A 'attack':10A 'cat':2A 'cve':12A,15A 'dianp':1A 'login':3A 'open':7A 'paramet':5A 'redirect':4A,8A 'site':11A","search_b":"'address':40B 'attack':44B 'bounc':51B 'cat':20B,27B 'contain':42B 'craft':48B 'dianp':19B,26B 'dianping-cat':18B 'handler':30B 'host':25B 'java':21B 'link':49B 'login':61B 'login/logout':29B 'malici':58B 'packag':22B 'paramet':34B 'phish':56B 'redirect':36B 'rtnurl':33B 'self':24B 'self-host':23B 'send':46B 'site':59B 'trust':31B 'user':37B 'victim':53B 'whatev':39B","search_c":"'/3.1.0/4.0-rc1':71C '3.0.0':70C 'affect':73C 'argument':90C 'attack':98C 'cat':69C 'compon':83C 'contact':116C 'dianp':68C 'disclosur':120C 'earli':117C 'execut':85C 'exploit':105C 'file':79C 'flaw':63C 'found':66C 'function':75C 'handler.java':80C 'handler.redirect':76C 'lead':93C 'login/logout':84C 'manipul':87C 'may':99C,110C 'open':95C 'perform':101C 'publish':108C 'redirect':96C 'remot':103C 'respond':124C 'rtnurl':91C 'use':112C 'vendor':114C 'way':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T01:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124505","severity":null,"published_at":"2026-11-09T01:17:02+00:00","modified_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","fetched_at":"2026-11-09T01:23:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}