CVE-2025-11222: Central Dogma Server Auth Shiro Open Redirect Vulnerability
Summary
CVE-2025-11222: Central Dogma's Login Function Has an Open Redirect Vulnerability. Affects com.linecorp.centraldogma:centraldogma-server-auth-shiro versions < 0.78.0. Fixed in 0.78.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Central Dogma is a collaborative version control system designed for managing and deploying microservices. It allows teams to manage code and configuration changes efficiently. The 'centraldogma-server-auth-shiro' package provides authentication features using Apache Shiro, which is widely used for securing web applications. However, a recently discovered open redirect vulnerability poses a risk to users by allowing attackers to redirect victims to malicious sites.
Vulnerability Detail
The open redirect vulnerability in Central Dogma's login function allows attackers to craft malicious links that redirect users to phishing websites mimicking the legitimate login page. This vulnerability arises from improper validation of redirect URLs, which can lead to user credential theft and unauthorized access to sensitive information. The potential ramifications include compromised user accounts and loss of trust in the application.
How To Fix
Minimum fixed version
0.78.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, implement the 'AuthProvider' to override the 'webLoginService()' method. This can help mitigate the risk until the package is updated. Example code snippet:
public class CustomAuthProvider extends AuthProvider { @Override public void webLoginService() {
// Custom implementation to handle login securely
}
}
Conclusion
The open redirect vulnerability in Central Dogma's login function poses a significant risk to user accounts and application security. It is crucial for server operators to upgrade to the patched version to mitigate these risks. Implementing the suggested workaround can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for com.linecorp.centraldogma:centraldogma-server-auth-shiro →
FAQ
An open redirect vulnerability allows attackers to redirect users to an external site, often for phishing or malicious purposes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time based on your pom.xml.
Exploitation of this vulnerability can lead to credential theft and unauthorized access to user accounts.
Yes, upgrading to Central Dogma version 0.78.0 or later resolves the vulnerability.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.linecorp.centraldogma:centraldogma-server-auth-shiro.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
