CVE-2026-97325

Deferred Deferred - Pending Action

Open Redirect in RuoYi-Vue-Pro OAuth2 Client

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-97325

Affected Vendors & Products

Vendor	Product	Version / Range
yunai	ruoyi_vue_pro	to 2026.08 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an open redirect flaw in the OAuth2 Client component of YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.08. It allows attackers to manipulate the redirect_uri argument in the validOAuthClientFromCache function, leading users to malicious sites. The exploit is publicly available and can be used remotely.

Detection Guidance

This vulnerability involves an open redirect in the OAuth2 client component of ruoyi-vue-pro. To detect it, inspect the OAuth2ClientServiceImpl.java file for the validOAuthClientFromCache function and check if the redirect_uri parameter is properly validated. Look for any instances where user-controlled input is directly used in redirect logic without strict validation.

Impact Analysis

This vulnerability could trick users into visiting malicious websites by redirecting them from a trusted source. It may lead to phishing attacks, credential theft, or malware infections. Users interacting with the affected system might unknowingly expose sensitive information.

Mitigation Strategies

Immediately update ruoyi-vue-pro to the latest version if available. If no patch exists, disable the OAuth2 client component or restrict access to it. Implement strict validation for the redirect_uri parameter to ensure it only allows trusted URLs. Monitor network traffic for suspicious redirect patterns.

Hi! I’m here to help you understand CVE-2026-97325. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70