CVE-2026-16222

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16222

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16222.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16222

Published

2026-07-19T06:45:09.639Z

Modified

2026-07-22T05:30:01.166969504Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

Details

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16222.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/1panel-dev/cordyscrm

Affected ranges

Type

GIT

Repo

https://github.com/1panel-dev/cordyscrm

Events

Introduced

d8ba007763a83f13897c8bb7c1cec53188b7655d

Last affected

92fb1d684a908ea9e6ead049d062eb433c68ded1

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.4.0

1.4.1

v1.*

v1.4.0

v1.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16222.json"