Which versions of yudao-cloud are affected by EUVD-2026-26814?

YunaiV yudao-cloud versions up to 2026.01 contain an authentication bypass vulnerability (CVE-2026-7679) in OAuth2 token handling that allows remote attackers to obtain unauthorized access tokens…

Is there a public PoC exploit available for EUVD-2026-26814?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26814. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-26814?

Within 24 hours: Identify all deployed instances of yudao-cloud and document current versions in use; contact YunaiV for patch status confirmation and estimated timeline. Within 7 days: Implement network segmentation to restrict unauthenticated access to the OAuth2 token endpoint (getAccessToken function) via WAF rules or API gateway controls; enable authentication audit logging on all token requests. Within 30 days: Upgrade to patched version once vendor releases fix; if no patch is released within 30 days, evaluate alternative cloud IAM solutions or deploy compensating controls (reverse proxy with token validation, rate limiting, IP whitelisting) as interim measures.

yudao-cloud EUVD-2026-26814

Q: What is the CVSS score of EUVD-2026-26814?

EUVD-2026-26814 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-7679 MEDIUM

Improper Authentication (CWE-287)

2026-05-03 VulDB

Java Authentication Bypass

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 03, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

May 03, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

May 03, 2026 - 05:15 vuln.today

Public exploit code

Analysis Generated

May 03, 2026 - 05:01 vuln.today

EUVD ID Assigned

May 03, 2026 - 04:30 euvd

EUVD-2026-26814

Analysis Generated

May 03, 2026 - 04:30 vuln.today

CVE Published

May 03, 2026 - 04:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in YunaiV yudao-cloud (versions up to 2026.01) allows remote unauthenticated attackers to obtain unauthorized access tokens via manipulation of the getAccessToken function in OAuth2TokenServiceImpl.java. Public exploit code exists (GitHub PoC available), enabling attackers to bypass authentication controls and gain low-level access to confidential data, integrity, and availability. EPSS risk assessment unavailable, but the combination of network attack vector, low complexity (AC:L), no authentication requirement (PR:N), and publicly available exploit creates immediate exploitation risk. Vendor was notified but did not respond, leaving no official patch timeline.

Technical ContextAI

This vulnerability affects the OAuth2 token generation mechanism in yudao-cloud, a Java-based microservices framework. The flaw resides in OAuth2TokenServiceImpl.java within the yudao-module-system-biz module, specifically in the getAccessToken function responsible for issuing OAuth2 access tokens. CWE-287 (Improper Authentication) indicates the implementation fails to correctly verify authentication credentials or authorization context before token issuance. This likely involves insufficient validation of client credentials, missing state checks, or improper token generation logic that allows attackers to craft requests that bypass authentication gates. The affected CPE (cpe:2.3:a:yunaiv:yudao-cloud) confirms all versions through 2026.01 contain the vulnerable code path.

RemediationAI

No vendor-released patch exists at time of analysis-YunaiV was contacted during responsible disclosure but did not respond per the CVE description. Organizations must implement compensating controls immediately. Primary mitigation: Restrict network access to OAuth2 token endpoints (specifically paths invoking OAuth2TokenServiceImpl.getAccessToken) using firewall rules or reverse proxy ACLs to trusted IP ranges only, eliminating remote unauthenticated access (trade-off: breaks public API integrations requiring token issuance). Secondary mitigation: Implement additional authentication layer via API gateway or WAF with strict request validation before requests reach the vulnerable getAccessToken function (trade-off: added latency and operational complexity). Review application logs for suspicious token generation patterns-unusual client IDs, high-frequency token requests from single sources, or tokens issued without corresponding authentication events. Monitor the GitHub PoC at https://github.com/9str0IL/CVE/issues/1 and VulDB references for potential community patches or updated exploitation techniques. Consider migrating to alternative OAuth2 implementations or forking yudao-cloud to apply custom patches if source code access permits. All mitigations are temporary until vendor provides official security update.