CVE-2025-15222

Name of the Vulnerable Software and Affected Versions Dromara Sa-Token versions prior to 1.45.0

Description A flaw exists in Dromara Sa-Token up to version 1.44.0 related to deserialization. The issue is located in the ObjectInputStream.readObject function within the SaSerializerTemplateForJdkUseBase64.java file. This allows for remote manipulation with high complexity and difficult exploitability. The exploit has been publicly disclosed. The vendor was informed but did not respond.

Recommendations Update Dromara Sa-Token to version 1.45.0 or later. As a temporary workaround, consider restricting access to the SaSerializerTemplateForJdkUseBase64.java file.