CVE-2026-7710: YunaiV yudao-cloud Auth Bypass Flaw

CVE-2026-7710 Overview

CVE-2026-7710 is an improper authentication vulnerability in YunaiV yudao-cloud versions up to 3.8.0. The flaw resides in the doFilterInternal function of JwtAuthenticationTokenFilter.java within the Ruoyi-Vue-Pro component. Attackers manipulate the mock-token argument to bypass authentication controls remotely. The weakness is classified under [CWE-287] Improper Authentication. Public exploit code has been released, and the vendor did not respond to early disclosure attempts.

Critical Impact
Remote attackers can bypass JWT authentication by manipulating the mock-token parameter, gaining unauthorized access to protected application endpoints without valid credentials.

Affected Products

YunaiV yudao-cloud versions up to and including 3.8.0
Ruoyi-Vue-Pro component (JwtAuthenticationTokenFilter.java)
Deployments exposing the affected JWT filter to network access

Discovery Timeline

2026-05-04 - CVE-2026-7710 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7710

Vulnerability Analysis

The vulnerability resides in the JWT authentication filter chain of yudao-cloud, a Spring Cloud-based enterprise rapid development platform. The doFilterInternal method in JwtAuthenticationTokenFilter.java processes incoming requests and validates authentication tokens before forwarding them to protected resources.

The filter accepts a mock-token parameter intended for development or testing scenarios. Improper handling of this parameter allows attackers to supply crafted values that the filter accepts as valid authentication context. This results in authenticated session establishment without legitimate credential verification.

The EPSS score is 0.061% with a percentile of 18.936, indicating low near-term exploitation probability despite public proof-of-concept availability. The classification under [CWE-287] reflects an authentication mechanism that fails to verify identity claims correctly.

Root Cause

The root cause is the inclusion of a development-oriented mock-token code path in production builds of the Ruoyi-Vue-Pro component. The filter trusts the mock-token argument without enforcing environment-based gating or cryptographic validation. Any client capable of reaching the filter endpoint can supply this argument and obtain authentication context.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker sends an HTTP request to a yudao-cloud endpoint protected by JwtAuthenticationTokenFilter, including the mock-token parameter with attacker-chosen content. The filter processes the parameter and grants access to downstream protected resources.

The vulnerability mechanism is detailed in the GitHub Issue on CVE and the VulDB Vulnerability Details. No verified exploit code is reproduced here; refer to the linked references for technical proof-of-concept artifacts.

Detection Methods for CVE-2026-7710

Indicators of Compromise

HTTP requests containing the mock-token parameter directed at yudao-cloud or Ruoyi-Vue-Pro endpoints
Authentication events in application logs lacking corresponding credential validation entries
Anomalous session creation from external IP addresses against administrative or API endpoints
Access to privileged resources by sessions never observed completing standard login flows

Detection Strategies

Inspect web server and reverse proxy logs for query strings or headers containing mock-token
Correlate authentication success events with the presence of standard JWT issuance log entries to identify mismatches
Deploy WAF rules that flag or block requests containing the mock-token parameter on production endpoints
Monitor for spikes in authenticated requests originating from previously unseen client fingerprints

Monitoring Recommendations

Enable verbose logging for JwtAuthenticationTokenFilter to record all token validation paths taken
Forward application and gateway logs to a centralized analytics platform for correlation across hosts
Track request rates against authentication endpoints and alert on deviations from baseline patterns
Audit access to sensitive APIs and administrative interfaces on a continuous basis

How to Mitigate CVE-2026-7710

Immediate Actions Required

Block requests containing the mock-token parameter at the perimeter using WAF or reverse proxy rules
Restrict network access to yudao-cloud administrative and API endpoints to trusted source ranges
Review authentication and session logs for prior abuse of the mock-token parameter
Rotate credentials and JWT signing keys if exploitation evidence is identified

Patch Information

No vendor-supplied patch is referenced in the published advisory data, and the vendor did not respond to early disclosure outreach. Operators should monitor the yudao-cloud GitHub repository for upstream fixes. Until a patch is released, apply compensating controls and consider forking the JwtAuthenticationTokenFilter.java source to remove the mock-token code path.

Workarounds

Remove or disable the mock-token handling logic in JwtAuthenticationTokenFilter.java and rebuild the application
Enforce environment checks so any mock authentication paths execute only in non-production profiles
Place the application behind an authenticating reverse proxy that strips the mock-token parameter from inbound requests
Apply network segmentation to limit exposure of the affected service to untrusted networks

bash

# Example WAF rule to block mock-token parameter (ModSecurity syntax)
SecRule ARGS_NAMES|REQUEST_HEADERS_NAMES "@streq mock-token" \
    "id:1027710,phase:1,deny,status:403,\
    msg:'CVE-2026-7710 mock-token authentication bypass attempt'"