Advisories for Maven/Com.linecorp.centraldogma/Centraldogma-Server-Auth-Shiro package

Threat model: any unauthenticated network client that can reach the Central Dogma login page. No prior account, no MITM position required — the attack is performed during a normal login request. Authentication confusion — In AD environments that select this realm (the canonical LINE corporate scenario), typing username * causes the realm to look up the first directory entry (typically Administrator, admin, or a service account in alphabetical AD ordering) …

Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and unauthorized access to the Central Dogma instance.