The vulnerability is in the doFilterInternal method of JwtAuthenticationTokenFilter.java within the Ruoyi‑Vue‑Pro component of YunaiV yudao‑cloud. By manipulating the mock-token argument, an attacker can bypass authentication controls and assume the identity of a legitimate user. The flaw is identified as a CWE-287 weakness where credentials are not properly verified. According to the vendor, mock-enable is an explicit development feature that must be disabled in production; simply changing the mock secret does not disable it, and no authentication-code patch has been released. The public exploit is already available, allowing remote attackers to impersonate users via crafted HTTP requests.

Versioned binaries of YunaiV yudao-cloud up to and including 3.8.0 are affected. The weakness specifically targets the code path inside JwtAuthenticationTokenFilter.java of the Ruoyi‑Vue‑Pro framework, implying that any deployment of this library within that version range is at risk.

The CVSS score of 6.9 classifies the defect as a moderate severity issue, though the public availability of a working exploit raises immediate concern. With an EPSS score of 0.00405, the estimated exploitation probability is very low, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the remote nature of the attack vector and related authentication bypass allow an adversary to impersonate users over the network. The likely attack path involves sending a crafted HTTP request containing a manipulated mock-token parameter to the authentication endpoint, which then accepts the request and authenticates the attacker.