This vulnerability exists in the OAuth2 Client component of ruoyi-vue-pro (version 2026.08) within the validOAuthClientFromCache function. Improper validation of the redirect_uri argument allows an attacker to craft URLs that redirect users to unintended external sites, constituting an open redirect vulnerability. The flaw can be exploited remotely without authentication. Public exploit code has been published. The vendor was contacted but has not provided any response or patch to date.

Successful exploitation enables attackers to redirect users to arbitrary external websites, which can facilitate phishing attacks or other social engineering tactics. The vulnerability does not directly compromise system integrity or confidentiality but can be leveraged as part of broader attack chains. The medium CVSS score reflects the moderate risk posed by this open redirect issue.

No official fix or patch has been released by the vendor as of now. Users should monitor the vendor's channels for updates. Until a patch is available, avoid using the affected version 2026.08 in sensitive environments or implement custom validation to restrict redirect_uri parameters to trusted URLs.