This vulnerability in JeecgBoot (<=3.9.2) involves an open redirect issue in the Third-Party Login functionality, specifically in the HttpServletResponse.sendRedirect method within ThirdLoginController.java. An attacker can manipulate the redirect target parameter, causing the application to redirect users to arbitrary URLs. Exploitation requires a high degree of complexity, including social engineering to induce victims to click a malicious OAuth login link. The feature affected is optional and may not be enabled in many instances. No official fix or patch has been published as of the data provided.

Successful exploitation could redirect users to attacker-controlled sites, potentially facilitating phishing or other social engineering attacks. However, the vulnerability requires user interaction and social engineering, limiting its practical exploitability. The low CVSS score (2.3) reflects the low severity and difficulty of exploitation. There is no indication of direct compromise of system integrity or data confidentiality from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires user interaction and the affected feature is optional, disabling third-party login features if not needed can reduce exposure. Users should be cautious of suspicious OAuth login links and avoid clicking untrusted URLs. Monitor vendor channels for any official patches or updates addressing this issue.