CVE-2026-7710High· 7.3▾ MidnightPoC availableA security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument moc…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in improper authentication. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. It is suggested to update the configuration settings. The vendor explains: "[I]t remains an explicit development feature. Production deployments must disable mock-enable; changing the mock secret alone does not disable it. We added deployment guidance, not an authentication-code patch."
yudao-cloud 3.0yudao-cloud 3.1yudao-cloud 3.2yudao-cloud 3.3yudao-cloud 3.4yudao-cloud 3.5yudao-cloud 3.6yudao-cloud 3.7yudao-cloud 3.8.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7679High· 7.3YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
CVE-2026-7678Medium· 6.3YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2026-5147High· 7.3YunaiV yudao-cloud get-by-website sql injection
CVE-2026-116006High· 7.3YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
CVE-2025-10277Medium· 6.3A vulnerability was detected in YunaiV yudao-cloud up to 2025.09