CVE-2025-6552: java-aodeng Hope-Boot Login WebController.java doLogin redirect

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-24 · updated 2026-06-17
Weakness: CWE-601

Description

A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

java-aodeng Hope-Boot: 1.0.0

References

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md#steps-to-reproduce
https://vuldb.com/?ctiid.313692
https://vuldb.com/?id.313692
https://vuldb.com/?submit.596681

Get alerted when CVE-2025-6552 or the next vulnerability affects your stack