yudao-cloud EUVD-2026-26814

Remote unauthenticated exploitation against default yudao-cloud OAuth2 endpoints-no special configuration, privileges, or user interaction required per CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires only network reachability to the OAuth2 token issuance endpoint (typically exposed on standard HTTP/HTTPS ports in microservices deployments). Limiting factors: The scope unchanged (S:U) indicates the vulnerability is confined to the OAuth2 authentication boundary and does not enable lateral movement beyond the application's security context. The Low impact ratings (C:L/I:L/A:L) suggest the improperly issued tokens grant restricted rather than administrative privileges, limiting the attacker to operations within normal authenticated user permissions. Organizations not exposing yudao-cloud OAuth2 endpoints to untrusted networks (e.g., internal-only deployments behind strict network segmentation) face significantly reduced risk despite the vulnerability existing in the code.

The CVSS 7.3 (High) score reflects network-based exploitation (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), resulting in partial impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The E:P (Proof-of-Concept) temporal metric confirms public exploit availability via the referenced GitHub issue. However, RL:X (Report Level: Not Defined) indicates no vendor remediation timeline exists, as the vendor did not respond to disclosure. While EPSS data is unavailable, the combination of remote unauthenticated exploitation, public PoC, and authentication bypass in an OAuth2 implementation creates HIGH real-world risk for organizations using yudao-cloud in internet-facing deployments. The lack of vendor response elevates risk further-no official patch exists and organizations must rely on workarounds or third-party fixes. Priority should be CRITICAL for any production deployments, especially those exposing OAuth2 endpoints externally. The low individual impact ratings (C/I/A all Low) suggest token abuse grants limited access rather than full system compromise, but this still enables persistent unauthorized access across the microservices architecture.

An external attacker identifies a yudao-cloud deployment exposing OAuth2 endpoints to the internet. Using the publicly available GitHub proof-of-concept exploit (https://github.com/9str0IL/CVE/issues/1), the attacker crafts malicious HTTP requests targeting the getAccessToken function with manipulated parameters that bypass authentication checks. The vulnerable OAuth2TokenServiceImpl issues valid access tokens without proper credential verification, granting the attacker authenticated session context. With these tokens, the attacker accesses protected microservices APIs, exfiltrates limited confidential data, modifies application state within token permissions, or disrupts service availability-achieving the Low confidentiality, integrity, and availability impacts reflected in the CVSS score.