CVE-2026-7679 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
Remote attackers can bypass authentication in the getAccessToken function to gain unauthorized access to the yudao-cloud system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7679?
CVE-2026-7679 is a medium-severity authentication bypass vulnerability in YunaiV yudao-cloud, published on 3 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "[W]e intentionally retain the existing generic compatibility path that accepts a valid, unexpired stored refresh token when an access-token lookup is unavailable, for integrations such as reports and WebSocket. We are not introducing strict access-token-only verification, new revocation behavior or a separate trusted-entry API. This is a retained compatibility decision, not a claim that this behavior follows the standard OAuth separation or that every identity/revocation scenario has been eliminated."
Weakness: CWE-287
Which versions are affected by CVE-2026-7679?
How do I fix CVE-2026-7679?
No fix has been published for CVE-2026-7679 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-7679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7679 exists.
Sources
Also known as GHSA-vgp3-r337-849c.