---
id: "CVE-2026-124505"
page: "https://infrastack.ai/live/CVE-2026-124505"
kind: "vulnerability"
aliases: ["CVE-2026-124505"]
title: "Dianping CAT: login redirect parameter allows open redirect to attacker sites"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dianping-cat", "java", "package", "self-hosted"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-09T01:17:02+00:00"
first_seen_at: "2026-11-09T01:23:57+00:00"
updated_at: "2026-11-09T01:25:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124505", "first_seen_at": "2026-11-09T01:23:57+00:00"}]
exploit_sources: []
---

# Dianping CAT: login redirect parameter allows open redirect to attacker sites

Link for people: https://infrastack.ai/live/CVE-2026-124505 (this .md is for agents)

Dianping CAT's login/logout handler trusts the rtnUrl parameter and redirects users to whatever address it contains. An attacker can send a crafted link that bounces a victim to a phishing or malicious site after login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment runs Dianping CAT versions `3.0.0`, `3.1.0` or `4.0-RC1`
- Look in `Handler.java` (Login/Logout component) for the `redirect` function using `rtnUrl` without validation

## Timeline

- 2026-11-09T01:23:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124505

## From the sources

A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_