CVE-2026-51937 Details
Description
An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component
A vulnerability in Oneblog version 2.3.9 allows remote attackers to access sensitive WeChat Official Account tokens. This issue arises from the 'blog-web' module, which lacks authentication and authorization for its API endpoints. The vulnerability can be exploited by sending an unauthenticated POST request to the '/api/jssdkGetSignature' endpoint, which then returns the 'access_token' and 'jsapi_ticket' directly to the attacker. These tokens can be used to perform various actions on behalf of the WeChat Official Account, such as sending messages to followers or accessing user data.
Remove 'access_token' and 'jsapi_ticket' from the response of the '/api/jssdkGetSignature' endpoint. Alternatively, add authentication to the 'blog-web' module to require user authentication for sensitive endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zhangyd-c/OneBlog/issues/43 | CISA-ADP | AdvisoryExploitIssue TrackingTechnical AnalysisVendor |
| https://developers.weixin.qq.com/doc/offiaccount/Basic_Information/Get_access_token.html | [email protected] | Not Applicable |
| https://gist.github.com/Passwords404/2599df955cdb36b36b9551b5b7809114 | [email protected] | ExploitTechnical Analysis |
| https://github.com/zhangyd-c/OneBlog/issues/43 | [email protected] | AdvisoryExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| zhangyd-c OneBlog | <v2.3.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |