CVE-2026-7710: medium-severity vulnerability in YunaiV yudao-cloud
YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.4%
A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in improper authentication. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. It is suggested to update the configuration settings. The vendor explains: "[I]t remains an explicit development feature. Production deployments must disable mock-enable; changing the mock secret alone does not disable it. We added deployment guidance, not an authentication-code patch."
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
YunaiV · yudao-cloudpublic PoCs found — 1
cve_referencegithub.com/9str0IL/CVE/issues/5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — YunaiV yudao-cloud
In the same product, most dangerous first.
CVE-2026-7679MEDIUMYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authenticationEPSS 0.4%CVE-2026-58448HIGHyudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance APIEPSS 0.4%CVE-2026-9464MEDIUMYunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgeryEPSS 0.4%CVE-2026-5147MEDIUMYunaiV yudao-cloud get-by-website sql injectionEPSS 0.3%CVE-2025-10277MEDIUMYunaiV yudao-cloud submit improper authorizationEPSS 0.3%CVE-2025-10987MEDIUMYunaiV yudao-cloud HTTP Request transfer improper authorizationEPSS 0.3%