CVE-2026-107828: Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.
Affected Software
Event History
Frequently Asked Questions
Which user accounts are exposed to this issue?
Accounts created through Sina Weibo OAuth are exposed, because their passwords are derived from the associated Weibo user IDs. The affected behavior is present in Jivejdon through version 5.0.
What does an attacker need to exploit the issue?
An attacker does not need prior access or user interaction. They need a target's public Weibo user ID, from which they can derive the password using its first four digits and then use normal form login.
What could an attacker do after successfully exploiting this issue?
The attacker can log in as the affected Weibo-created account. This allows them to read content or post as the victim.