CVE-2023-43961: Dromara Sa-Token

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Affected products

• Dromara Sa-Token: before 1.36.0 (fixed in 1.36.0)

Published 2023-10-25. Last modified 2026-06-17.