CVE-2025-11222 Central Dogma's Login Function Has an Open Redirect Vulnerability
Attackers can redirect users to malicious sites via crafted URLs, facilitating phishing and credential theft in Central Dogma deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11222?
CVE-2025-11222 is a medium-severity vulnerability in LINE Corporation Central Dogma, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft.
Weakness: CWE-601
Which versions are affected by CVE-2025-11222?
2 open source packages ship an affected version, including com.linecorp.centraldogma:centraldogma-server-auth-shiro. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.linecorp.centraldogma:centraldogma-server-auth-shiro Maven | All versions | 0.78.0 |
com.linecorp.centraldogma:centraldogma-server-auth-shiro Maven | All versions | 0.78.0 |
Products include Linecorp Central Dogma.
How do I fix CVE-2025-11222?
Upgrade com.linecorp.centraldogma:centraldogma-server-auth-shiro to 0.78.0 or later.
Is CVE-2025-11222 being exploited?
There is no known exploitation of CVE-2025-11222 in the wild and no public exploit code.
Other vulnerabilities in LINE Corporation Central Dogma
Sources
Also known as GHSA-4hr2-xf7w-jf76.