CVE-2026-107828: Use of Weak Credentials in banq jivejdon

CVE-2026-107828 describes an authentication bypass vulnerability in banq's jivejdon product through version 5.0. The vulnerability arises because the OAuthAccountServiceImp.transferSina() function sets the password for Weibo-created accounts to the first four digits of the public Weibo user ID. Since these user IDs are public and predictable, attackers can derive these weak credentials and log in through the normal form login process without authentication, gaining unauthorized access to victim accounts.

Attackers can bypass authentication controls and gain unauthorized access to Weibo-linked accounts by exploiting predictable password derivation. This allows them to read private information or post content as the victim user, potentially leading to account compromise and misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Weibo account integration or enforcing stronger password policies for OAuth-created accounts to mitigate risk.