CVE-2026-16222
1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 19, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jul 18, 2026
Description
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
CordysCRM1Panel-dev |
|
References
- VDB-380044 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryvdb-entrytechnical-description
- VDB-380044 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-16222 | CVE Analysis and Reportthird-party-advisory
- Submit #858043 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgerythird-party-advisory
- Submit #858044 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery (Duplicate)third-party-advisory
- https://github.com/1Panel-dev/CordysCRM/issues/2685issue-tracking
- https://github.com/1Panel-dev/CordysCRM/issues/2686exploitissue-tracking
- https://github.com/1Panel-dev/CordysCRM/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.