CVE-2026-7679
Published: 03 May 2026
Summary
CVE-2026-7679 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-13 (Identity Providers and Authorization Servers) and IA-9 (Service Identification and Authentication).
Deeper analysis
CVE-2026-7679 is an improper authentication vulnerability (CWE-287) affecting YunaiV yudao-cloud versions up to 2026.01. The flaw resides in the getAccessToken function within the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. It allows manipulation that bypasses authentication mechanisms, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially allowing unauthorized access to OAuth2 tokens or related resources through improper authentication handling.
Advisories from VulDB and a GitHub issue on 9str0IL/CVE detail the vulnerability but note no vendor response despite early disclosure contact. An exploit is publicly available, increasing the risk of attacks, with no patches or official mitigations referenced. Security practitioners should monitor deployments, restrict network access to affected components, and consider manual code reviews or upgrades if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26814
Vulnerability details
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to…
more
the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote auth bypass in a public-facing OAuth2 token service, directly enabling exploitation of public-facing applications for initial access and token acquisition.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and remediation of the improper authentication flaw in the OAuth2 getAccessToken function.
Mandates secure requirements and protection for authorization servers, directly mitigating vulnerabilities in the affected OAuth2 token service.
Requires systems providing services to non-organizational entities to perform proper identification and authentication, preventing remote bypasses like this CVE.