What’s Vulnerable › Vulnerabilities

CVE-2026-7679: YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-03 · updated 2026-10-27
• Weakness: CWE-287

Description

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "[W]e intentionally retain the existing generic compatibility path that accepts a valid, unexpired stored refresh token when an access-token lookup is unavailable, for integrations such as reports and WebSocket. We are not introducing strict access-token-only verification, new revocation behavior or a separate trusted-entry API. This is a retained compatibility decision, not a claim that this behavior follows the standard OAuth separation or that every identity/revocation scenario has been eliminated."

Affected products

• YunaiV yudao-cloud: 2026.01

References

• https://github.com/9str0IL/CVE/issues/1
• https://vuldb.com/cve/CVE-2026-7679
• https://vuldb.com/submit/800866
• https://vuldb.com/vuln/360832
• https://vuldb.com/vuln/360832/cti

Get alerted when CVE-2026-7679 or the next vulnerability affects your stack