This vulnerability affects the getAccessToken function in the OAuth2TokenServiceImpl.java file of YunaiV yudao-cloud up to version 2026.01. An attacker can remotely manipulate this function to achieve improper authentication, potentially bypassing normal access controls. The issue is classified as an authentication bypass with low vector complexity and no privileges or user interaction required. The vendor has not provided any advisory or patch, and the exploit has been publicly disclosed.

Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms and gain unauthorized access to the affected system. This could lead to unauthorized actions or data exposure within the yudao-cloud environment. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing additional access controls or network-level restrictions to limit exposure of the affected service.