CVE-2026-7679: YunaiV yudao-cloud Auth Bypass Vulnerability

CVE-2026-7679 Overview

CVE-2026-7679 is an improper authentication vulnerability [CWE-287] in YunaiV yudao-cloud through version 2026.01. The flaw resides in the getAccessToken function within yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Attackers can manipulate the OAuth2 token service remotely without authentication. Public exploit code has been released, increasing the risk of opportunistic attacks. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Remote attackers can bypass authentication controls in the OAuth2 token service, enabling unauthorized access to protected application resources without valid credentials.

Affected Products

YunaiV yudao-cloud versions up to and including 2026.01
Component: yudao-module-system-biz OAuth2 token service
File: OAuth2TokenServiceImpl.java

Discovery Timeline

2026-05-03 - CVE-2026-7679 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7679

Vulnerability Analysis

The vulnerability affects the getAccessToken method in OAuth2TokenServiceImpl.java, which is responsible for issuing and validating OAuth2 access tokens. The implementation fails to enforce proper authentication checks during token retrieval. Remote attackers can manipulate token requests to obtain access without supplying valid credentials.

The weakness is classified under [CWE-287] Improper Authentication. According to EPSS data dated 2026-05-07, the exploitation probability is approximately 0.082%, placing it in the 23.78 percentile. Public exploit code has been released, which raises practical exploitation risk despite the lower EPSS estimate.

Root Cause

The root cause is missing or insufficient authentication validation in the OAuth2 token issuance flow. The getAccessToken function processes token requests without correctly verifying that the requester possesses valid credentials or authorization grants. This allows token issuance under attacker-controlled conditions.

Attack Vector

The attack is conducted over the network with low complexity. No prior authentication or user interaction is required. An attacker submits crafted requests to the OAuth2 token endpoint exposed by yudao-cloud and receives a token usable for accessing protected APIs. Since exploit code is public, attackers can weaponize the issue using existing tooling.

No verified exploit code is reproduced here. Refer to the GitHub CVE Issue Report and VulDB Vulnerability #360832 for technical details.

Detection Methods for CVE-2026-7679

Indicators of Compromise

Unexpected OAuth2 access token issuances without preceding authorization code or password grant flows
Successful API calls authenticated by tokens that lack a corresponding login event in audit logs
Anomalous source IPs requesting /oauth2/token endpoints at high volume
Token usage from geolocations or user agents inconsistent with legitimate user baselines

Detection Strategies

Audit OAuth2 token issuance logs for tokens generated without a matching client authentication event
Correlate access token usage with prior authentication records to identify orphaned sessions
Deploy WAF rules that inspect requests to the yudao-cloud /oauth2/token endpoint for malformed or suspicious parameters
Monitor for sudden increases in token issuance rates from a single client identifier

Monitoring Recommendations

Enable verbose logging in OAuth2TokenServiceImpl to capture all token grant attempts with source metadata
Forward authentication telemetry to a centralized SIEM for correlation with downstream API activity
Establish baselines for normal OAuth2 token issuance volume and alert on deviations
Review access logs for protected resources to detect privilege misuse following anomalous token grants

How to Mitigate CVE-2026-7679

Immediate Actions Required

Restrict network access to the yudao-cloud OAuth2 token endpoint to trusted clients and IP ranges
Rotate all active OAuth2 client secrets and revoke existing access tokens to invalidate any tokens issued through abuse
Place the application behind a reverse proxy or API gateway that enforces additional authentication checks
Audit recent token issuance and downstream resource access for signs of exploitation

Patch Information

No vendor patch has been published at the time of disclosure. The vendor did not respond to disclosure communications. Monitor the YunaiV yudao-cloud project and VulDB Submission #800866 for upstream remediation updates.

Workarounds

Implement a custom authentication filter in front of OAuth2TokenServiceImpl.getAccessToken to validate client credentials before reaching the vulnerable code path
Disable the affected OAuth2 grant types if not required by production workloads
Apply mutual TLS (mTLS) on the token endpoint to require client certificate authentication
Reduce token lifetimes and enforce strict scope limits to minimize impact of unauthorized token issuance

bash

# Example nginx restriction limiting OAuth2 token endpoint to trusted CIDR
location /oauth2/token {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://yudao-cloud-backend;
}