TI-2026-06761 Aliases CVE-2026-7679 GHSA-vgp3-r337-849c

YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

MEDIUM 64CWE-287Published 2026-05-03 · Updated 2026-10-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "[W]e intentionally retain the existing generic compatibility path that accepts a valid, unexpired stored refresh token when an access-token lookup is unavailable, for integrations such as reports and WebSocket. We are not introducing strict access-token-only verification, new revocation behavior or a separate trusted-entry API. This is a retained compatibility decision, not a claim that this behavior follows the standard OAuth separation or that every identity/revocation scenario has been eliminated."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00416 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
YunaiV	yudao-cloud	2026.01	—	No fix listed	CNA

yudao-cloud VendorYunaiV Affected 2026.01 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:yunaiv:yudao-cloud::::::::	—	—	—

cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-7679
2026-10-03 Alias added: GHSA-vgp3-r337-849c
2026-10-13 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile
2026-10-27 CVSS score changed · CNA

References

Exploit 1

https://github.com/9str0IL/CVE/issues/1

TI-2026-80126 Improper authentication in YunaiV ruoyi-vue-pro SMS code verification CVSS 4.0MEDIUM 6.9
TI-2026-11453 Path traversal in YunaiV ruoyi-vue-pro CVSS 4.0MEDIUM 6.9
TI-2026-06792 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-04492 YunaiV yudao-cloud get-by-website sql injection CVSS 4.0MEDIUM 6.9
TI-2026-80085 Authorization bypass in yudao-cloud lets users evade data scope CVSS 4.0HIGH 7.1
TI-2026-42058 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API CVSS 4.0HIGH 7.1

See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences