Yuxi
Monthly
Administrator authentication bypass in Yuxi (xerrors/Yuxi), a large-model-based knowledge base and knowledge-graph agent platform, affects all versions prior to 0.6.2. Because the backend only checks that a JWT is validly signed - without binding it to the specific deployment instance - an admin token minted in any other Yuxi instance, a local test environment, or one forged with the hardcoded default secret 'yuxi_know_secure_key' is accepted as a valid administrator, yielding full backend takeover. There is no public exploit identified at time of analysis, but the fix commit and the hardcoded default key are publicly visible on GitHub, making token forgery trivial wherever the secret was never changed.
Administrator authentication bypass in Yuxi (xerrors/Yuxi), a large-model-based knowledge base and knowledge-graph agent platform, affects all versions prior to 0.6.2. Because the backend only checks that a JWT is validly signed - without binding it to the specific deployment instance - an admin token minted in any other Yuxi instance, a local test environment, or one forged with the hardcoded default secret 'yuxi_know_secure_key' is accepted as a valid administrator, yielding full backend takeover. There is no public exploit identified at time of analysis, but the fix commit and the hardcoded default key are publicly visible on GitHub, making token forgery trivial wherever the secret was never changed.