JeecgBoot versions 3.9.0, 3.9.1, and 3.9.2 contain an open redirect vulnerability in the Third-Party Login component, specifically in the HttpServletResponse.sendRedirect call within ThirdLoginController.java. This vulnerability allows an attacker to manipulate the redirect URL parameter, potentially redirecting users to arbitrary external sites. Exploitation requires a high degree of complexity, including social engineering to convince victims to click a crafted OAuth login link. The vulnerability cannot be triggered passively and is limited by the optional nature of the third-party login feature. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation could redirect users to attacker-controlled websites, potentially facilitating phishing or other social engineering attacks. However, the impact is limited by the requirement for user interaction and the optional status of the affected feature. The CVSS 4.0 base score is 2.3, indicating low severity and low exploitability in real-world scenarios.

No official patch or remediation has been announced. Users should evaluate whether the third-party login feature is enabled and consider disabling it if not needed. Additionally, caution should be exercised with OAuth login links, and users should be educated to avoid clicking suspicious or unsolicited links. Monitor vendor advisories for any future updates or patches addressing this issue.