CVE-2021-4461 Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass
Attackers can bypass authentication to assign sessions to arbitrary user IDs, leading to account takeover in Seeyon Zhiyuan OA systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4461?
CVE-2021-4461 is a critical authentication bypass vulnerability in Seeyon Zhiyuan OA Web Application System, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
Weakness: CWE-306
Which versions are affected by CVE-2021-4461?
How do I fix CVE-2021-4461?
No fix has been published for CVE-2021-4461 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-4461 being exploited?
There is no known exploitation of CVE-2021-4461 in the wild and no public exploit code.
Sources
Also known as GHSA-vjp9-58v6-m6fw.