This vulnerability in YunaiV yudao-cloud up to version 2026.01 allows an attacker to bypass authentication controls by manipulating the getAccessToken function in the OAuth2TokenServiceImpl.java source file. The issue is classified as improper authentication and can be triggered remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vendor has not provided any advisory or patch, and no official remediation is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass authentication mechanisms, potentially gaining unauthorized access to protected resources or services within the affected application. The lack of vendor response and public exploit availability increases the risk of exploitation, although no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should monitor for updates from the vendor or community. Until a fix is released, consider restricting external access to the affected service and applying compensating controls where possible.