CVE-2026-124505: Dianping CAT Login/Logout Handler.java Handler.redirect
A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must cause a user to interact with a crafted remote request that manipulates the rtnUrl argument processed by the Login/Logout Handler.redirect function. No attacker privileges are required.
Which releases are identified as affected?
The affected releases listed are Dianping CAT 3.0.0, 3.1.0, and 4.0-RC1.
Is exploitation known to be practical?
Yes. A public exploit has been published and may be used.
Is there a vendor-provided fix or response documented?
No vendor response is documented. The vendor was contacted early about the disclosure but did not respond.