CVE-2026-7710

Summary

A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in improper authentication. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
YunaiVyudao-cloud3.0affected
YunaiVyudao-cloud3.1affected
YunaiVyudao-cloud3.2affected
YunaiVyudao-cloud3.3affected
YunaiVyudao-cloud3.4affected
YunaiVyudao-cloud3.5affected
YunaiVyudao-cloud3.6affected
YunaiVyudao-cloud3.7affected
YunaiVyudao-cloud3.8.0affected

Weaknesses

  • CWE-287: Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References