CVE-2026-107828

MediumCVSS 6.5/10Last modified Oct 9, 2026

Description

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1391

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1078295.9Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash CVE-2026-107832.5A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache CVE-2026-1078305.3Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by Sm CVE-2026-1078314.3Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by a CVE-2026-1078323.7fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names de CVE-2026-1078335.9OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bo CVE-2026-1078345.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal CVE-2026-1078354.0OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in inter CVE-2026-1078367.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and e CVE-2026-1078378.2RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and e CVE-2026-1078387.5RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 202 CVE-2026-1078397.5ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games.