CVE-2026-126998: JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery
A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
JeecgBoot versions up to and including 3.9.5 are identified as affected. The vulnerable functionality is the OpenApiController.call endpoint at /openapi/call in the Authentication Filter component.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
How mature is the exploitation risk?
A public exploit has been released, and the vulnerability is flagged as having a proof of concept. This increases the likelihood of attempted remote exploitation.