CVE-2026-7679

YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

View on CVE.org
Published May 3, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "[W]e intentionally retain the existing generic compatibility path that accepts a valid, unexpired stored refresh token when an access-token lookup is unavailable, for integrations such as reports and WebSocket. We are not introducing strict access-token-only verification, new revocation behavior or a separate trusted-entry API. This is a retained compatibility decision, not a claim that this behavior follows the standard OAuth separation or that every identity/revocation scenario has been eliminated."

Analysis

AI-generated

Technical impact

The vulnerability originates in the OAuth2TokenServiceImpl component of YunaiV yudao-cloud, where the getAccessToken method, as part of the yudao-module-system-biz module, accepts an unexpired stored refresh token even when a matching access token cannot be found. This retained compatibility path bypasses the intended access‑token‑only verification, allowing an attacker to manipulate the request and obtain a valid access token without proper authentication. The flaw is remotely exploitable and code is publicly available.

Affected Systems

All instances of YunaiV yudao-cloud running any version up to and including 2026.01 are affected. The vulnerability is confined to the yudao-module-system-biz module, specifically the OAuth2TokenServiceImpl.java file.

Risk and Exploitability

The CVSS score of 6.9 signifies a moderate severity vulnerability. EPSS score of 0.00414 (less than 1%) and the issue is not listed in CISA's KEV catalog, but the description notes that the exploitation code is publicly available and can be triggered remotely. The lack of vendor response further heightens the risk until a definitive fix is released.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • When a vendor patch becomes available, update YunaiV yudao‑cloud to the patched version immediately.
  • If no patch is currently released, limit exposure by blocking or restricting access to the OAuth2 token endpoint through firewall rules or an API gateway that enforces additional authentication controls before reaching getAccessToken.
  • Continuously review authentication logs for abnormal or repeated token requests and configure alerts for unusual activity patterns.
  • Contact the vendor to request an estimated remediation timeline, and in the interim, apply additional safeguards such as enforcing client credentials or multi‑factor authentication for any OAuth flows in use.

Generated by OpenCVE AI on October 27, 2026 at 10:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "[W]e intentionally retain the existing generic compatibility path that accepts a valid, unexpired stored refresh token when an access-token lookup is unavailable, for integrations such as reports and WebSocket. We are not introducing strict access-token-only verification, new revocation behavior or a separate trusted-entry API. This is a retained compatibility decision, not a claim that this behavior follows the standard OAuth separation or that every identity/revocation scenario has been eliminated."
CPEs cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Yunaiv
Yunaiv yudao-cloud
Vendors & Products Yunaiv
Yunaiv yudao-cloud
Type Values Removed Values Added
Description A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
Weaknesses CWE-287
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 27, 2026, 7:22 AM
Reserved
May 2, 2026, 8:39 AM

View source JSON

Updated
May 4, 2026, 2:55 PM

JSON

Status
Deferred
Published
May 3, 2026, 5:15 AM
Modified
Oct 27, 2026, 8:16 AM

View source JSON

No data.

Updated
Oct 27, 2026, 10:45 AM

JSON