YunaiV

An improper authentication vulnerability in the SMS Code Verification component of ruoyi-vue-pro allows remote attackers to bypass authentication mechanisms by manipulating the mobile or code arguments in AuthController.java.

A remote authorization bypass in the ruoyi-vue-pro payment callback handler allows unauthorized manipulation of payment order states via the ID argument.

YunaiV yudao-cloud up to version 3.8.0 is vulnerable to an authentication bypass (CVE-2026-7710) due to improper handling of the mock-token argument in the JwtAuthenticationTokenFilter.java file, allowing remote attackers to bypass authentication.

YunaiV yudao-cloud up to version 2026.01 is vulnerable to improper authentication due to a flaw in the getAccessToken function, allowing remote attackers to bypass authentication.