CVE-2026-90509

Name of the Vulnerable Software and Affected Versions dromara orion-visor versions prior to 2.5.8

Description A remote manipulation of the ExposeApiAspect.beforeExposeApi() function within the ExposeApiAspect.java file can lead to the exposure of hard-coded credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the ExposeApiAspect.beforeExposeApi() function to minimize the risk of exploitation.