CVE-2026-110106 — RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

2026-10-14T19:27:48.983135+00:00

Affected: dromara RuoYi-Vue-Plus

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.

Most recent entries from all

CVE-2026-110106 — RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}