CVE-2026-90509: dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Deployments of dromara/orion-visor up to version 2.5.7 should be treated as affected. The available information does not identify a configuration prerequisite or workaround.
Can this be exploited remotely without prior access?
Yes. The vulnerability is described as remotely exploitable, and the vector indicates network access with low attack complexity, no privileges, and no user interaction required.
Is public exploit information available?
Yes. A public exploit has been made available and could be used in attacks, so exposed instances should be prioritized for remediation or access restriction.
Is a vendor fix confirmed?
No vendor response or fix is stated. The project was notified through an issue report but had not responded at the time of publication.