CVE-2025-14086: Youlai-mall Auth Bypass Vulnerability

CVE-2025-14086 Overview

CVE-2025-14086 is an improper access control vulnerability in youlaitech youlai-mall versions 1.0.0 and 2.0.0. The flaw resides in an unspecified function handler at the /app-api/v1/members/openid/ endpoint. Manipulating the openid argument allows an authenticated remote attacker to bypass access controls and interact with member data outside their authorization scope. The exploit details have been disclosed publicly. The vendor was contacted prior to public disclosure but did not respond. This issue is categorized under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Remote attackers with low privileges can abuse the openid parameter to access member-scoped resources without proper authorization, affecting confidentiality, integrity, and availability of member data.

Affected Products

youlai youlai-mall 1.0.0
youlai youlai-mall 2.0.0
Endpoint: /app-api/v1/members/openid/

Discovery Timeline

2025-12-05 - CVE-2025-14086 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14086

Vulnerability Analysis

The vulnerability affects the members API in youlai-mall, an open-source e-commerce platform. The endpoint /app-api/v1/members/openid/ accepts an openid argument that uniquely identifies member accounts. The handler fails to enforce that the requesting user owns or is otherwise authorized for the supplied openid. As a result, an authenticated attacker can substitute another user's openid value and operate on records that belong to another member.

The weakness maps to [CWE-266] Incorrect Privilege Assignment, a class of broken access control. Exploitation requires only network access and low privileges, with no user interaction. Public disclosure on VulDB and the associated GitHub issue tracker increases the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is missing server-side authorization on the openid parameter. The endpoint trusts client-supplied identifiers without cross-checking them against the authenticated session principal. This pattern is a classic Insecure Direct Object Reference (IDOR), where object identifiers are exposed in the URL or request payload and resolved without authorization checks.

Attack Vector

An attacker authenticates to the application using any valid low-privileged account. The attacker then issues an HTTP request to /app-api/v1/members/openid/ substituting the openid value of a target member. Because the application does not verify ownership, the server returns or modifies data belonging to the targeted account. The attack is fully remote and requires no special tooling. Refer to the GitHub CVE Issue Discussion and VulDB CVE Information for additional technical context.

No verified exploit code is available for direct reproduction in this article.

Detection Methods for CVE-2025-14086

Indicators of Compromise

HTTP requests to /app-api/v1/members/openid/ containing openid values that do not match the authenticated session principal.
Unusual volume of sequential or enumerated openid parameter values from a single client or IP address.
Application logs showing member data reads or modifications attributed to user sessions that do not own the targeted records.

Detection Strategies

Compare the openid parameter in API requests against the session-bound user identifier and flag mismatches as authorization violations.
Deploy WAF or API gateway rules that monitor /app-api/v1/members/openid/ for parameter tampering patterns and enumeration behavior.
Correlate authentication logs with downstream member API access to identify cross-account access attempts.

Monitoring Recommendations

Enable verbose access logging for all /app-api/v1/members/* endpoints, capturing the requesting principal and the queried openid.
Alert on repeated 200-status responses where the requested openid differs from the caller's openid over short time windows.
Forward application and gateway logs to a centralized analytics platform for retention and correlation against authentication events.

How to Mitigate CVE-2025-14086

Immediate Actions Required

Restrict external exposure of /app-api/v1/members/openid/ to trusted networks until an upstream fix is available.
Implement a server-side authorization check that rejects requests when the supplied openid does not match the authenticated principal.
Audit recent application logs for evidence of cross-account access via the affected endpoint.

Patch Information

No vendor patch is currently available. The vendor did not respond to disclosure attempts as documented on VulDB #334477. Operators should track the GitHub CVE Issue Discussion for community-supplied fixes and apply them after independent review.

Workarounds

Add a reverse-proxy or API-gateway policy that injects the authenticated user's openid server-side and rejects client-supplied values.
Apply rate limiting and anomaly detection on the /app-api/v1/members/openid/ route to slow enumeration attempts.
Remove or disable the affected endpoint if business workflows do not require it.

bash

# Example NGINX policy to block client-supplied openid values on the affected route
location /app-api/v1/members/openid/ {
    if ($arg_openid) {
        return 403;
    }
    proxy_pass http://youlai-mall-backend;
}