CVE-2026-8196: JeecgBoot Auth Bypass Vulnerability

CVE-2026-8196 Overview

CVE-2026-8196 is an authorization bypass vulnerability in JeecgBoot 3.9.1, a low-code development platform. The flaw resides in an unknown function within jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java, part of the mLogin endpoint component. Remote attackers can exploit the weakness to bypass authorization controls protecting the mobile login flow. A public proof-of-concept has been published, raising the risk of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond. The issue is categorized under CWE-285 (Improper Authorization).

Critical Impact

Remote attackers can bypass authorization checks on the mLogin endpoint of JeecgBoot 3.9.1, with a public exploit available and no vendor patch released.

Affected Products

• JeecgBoot 3.9.1
• jeecg-module-system / jeecg-system-biz module
• mLogin endpoint exposed by LoginController.java

Discovery Timeline

• 2026-05-09 - CVE-2026-8196 published to NVD
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8196

Vulnerability Analysis

The vulnerability exists in the mLogin endpoint handler implemented in LoginController.java within the JeecgBoot system module. The endpoint performs authorization-related operations, including captcha verification associated with the mobile login workflow, without sufficiently enforcing access control. According to the public proof-of-concept hosted at V-009_mLogin_Captcha_Bypass, an attacker can manipulate the request to circumvent the captcha gate intended to throttle and validate mobile login attempts. While the underlying confidentiality impact is limited, the bypass weakens a security control that JeecgBoot relies on to protect downstream authentication logic from brute-force and automation abuse. The advisory rates exploitability as difficult and attack complexity as high, indicating that successful abuse requires specific conditions, but the published exploit reduces the practical barrier for attackers.

Root Cause

The root cause is improper authorization ([CWE-285]) in the mLogin endpoint logic. The controller does not adequately validate that a caller has satisfied the captcha or pre-authentication requirements before continuing the login flow, allowing the protective control to be skipped through crafted requests.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests directly to the exposed mLogin endpoint to bypass the captcha gate. No verified exploitation code is reproduced here; see the GitHub PoC Repository and VulDB #362348 for technical specifics.

Detection Methods for CVE-2026-8196

Indicators of Compromise

• High volume of POST requests to the JeecgBoot mLogin endpoint without prior captcha image retrieval requests in the same session.
• Repeated mobile login attempts from a single source IP using sequential or randomized phone numbers.
• Login traffic missing or replaying static captcha parameters across distinct sessions.

Detection Strategies

• Inspect application logs for mLogin invocations whose request flow does not include a preceding captcha generation call.
• Correlate web server access logs with backend LoginController debug logs to identify requests that reach login processing despite captcha validation failures.
• Add web application firewall (WAF) rules that score requests to /sys/mLogin or equivalent paths based on captcha parameter entropy and session reuse.

Monitoring Recommendations

• Alert on anomalous spikes in mobile login attempts and SMS code requests originating from a narrow set of IPs.
• Monitor outbound SMS gateway usage from the JeecgBoot application for unusual consumption tied to mLogin traffic.
• Track authentication failure-to-success ratios on mobile login to flag deviations consistent with automated abuse.

How to Mitigate CVE-2026-8196

Immediate Actions Required

• Restrict network exposure of the JeecgBoot mLogin endpoint to trusted networks or VPN users until a patch is available.
• Place a WAF or reverse proxy in front of JeecgBoot that enforces captcha presence, session binding, and per-IP rate limits on /sys/mLogin.
• Audit existing logs for prior abuse of the endpoint going back to deployment of version 3.9.1.

Patch Information

No vendor patch is referenced in the published advisory. The disclosure notes that the vendor was contacted but did not respond. Monitor the JeecgBoot project for updated releases superseding 3.9.1 and apply them once available. Track VulDB #362348 for advisory updates.

Workarounds

• Disable the mLogin mobile authentication endpoint if mobile login is not required by the deployment.
• Enforce strict captcha session binding at a reverse proxy layer, rejecting login requests that do not present a server-issued, single-use captcha token.
• Apply aggressive IP-based and account-based rate limiting on mobile login and SMS code issuance.
• Require multi-factor authentication on accounts reachable through the mobile login flow to reduce impact of captcha bypass.

# Example nginx rate limit and path restriction for the mLogin endpoint
limit_req_zone $binary_remote_addr zone=mlogin:10m rate=5r/m;

location /jeecg-boot/sys/mLogin {
    limit_req zone=mlogin burst=3 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://jeecgboot_upstream;
}