Insecure Direct Object Reference in RuoYi-Vue-Plus by Dromara

CVE-2026-110106

What is CVE-2026-110106?

RuoYi-Vue-Plus, up to version 6.0.0, is vulnerable to an insecure direct object reference (IDOR) issue that allows authenticated users to manipulate the social login experience. By sending a DELETE request to /auth/unlock/{socialId} with a victim's socialId, attackers can remove the victim's GitHub, WeChat, or Gitee binding, thereby invalidating their stored OAuth tokens and blocking their access to social login. This vulnerability highlights significant security concerns regarding user authentication and the management of social credentials.

References