Open Redirect Vulnerability in Dianping CAT Login Module
CVE-2026-124505

5.3MEDIUM

Key Information:

Vendor

Dianping

Status
Cat
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124505?

A flaw exists in the Handler.redirect function within the Login/Logout component of Dianping CAT versions 3.0.0, 3.1.0, and 4.0-RC1. This vulnerability allows attackers to manipulate the rtnUrl parameter, leading to potential open redirect attacks. Such attacks can be executed remotely, facilitating redirection to untrusted sites. Despite prior notification to the vendor, there has been no response regarding this security issue, making it critical for users to be aware of the risks associated with this vulnerability.

Affected Version(s)

CAT 3.0.0

CAT 3.1.0

CAT 4.0-RC1

References

https://vuldb.com/vuln/432809
vdb-entrytechnical-description
https://vuldb.com/vuln/432809/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124505
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.