JWT authentication bypass via cross-instance token reuse in Yuxi (CVE-2026-50561)

Yuxi's authentication mechanism fails to sufficiently validate the identity token in the Authorization header, performing only a validity check without binding tokens to a specific deployment instance. This allows an attacker who obtains or constructs a valid administrator JWT from any deployment instance or local testing environment to authenticate against a different affected instance, bypassing normal login and gaining full administrator privileges including access to system configurations, backend management APIs, and the ability to create administrator accounts. Affected versions: - < 0.6.2 We recommend updating to: 0.6.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/xerrors/Yuxi/security/advisories/GHSA-6959-99pq-c56x Details: https://vuln.today/cve/CVE-2026-50561