CVE-2026-8196

JeecgBoot mLogin Endpoint LoginController.java authorization

CVSS 6.3 MEDIUMEPSS 0.5%CWE-285 CWE-639

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.3EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 May 2026Published on NVD

13 May 2026Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

n/a · JeecgBoot

public PoCs found — 2

githubgithub.com/HORKimhab/CVE-2026-8196★ 1 cve_referencegithub.com/xpp3901/CVE_APPLY/tree/main/V-009_mLogin_Captcha_Bypassunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/xpp3901/CVE_APPLY/tree/main/V-009_mLogin_Captcha_Bypass https://vuldb.com/submit/803529 https://vuldb.com/vuln/362348 https://vuldb.com/vuln/362348/cti