This vulnerability affects the doFilterInternal method in JwtAuthenticationTokenFilter.java of the Ruoyi-Vue-Pro component in YunaiV yudao-cloud versions up to 3.8.0. By manipulating the mock-token argument, an attacker can bypass authentication mechanisms, resulting in improper authentication. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector and no required privileges. The vendor has not provided any advisory or patch, and the exploit has been publicly disclosed.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls, potentially gaining unauthorized access to the affected system. This could lead to unauthorized actions or data exposure depending on the system's configuration and usage. The medium severity score indicates a significant but not critical impact. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider implementing additional access controls or network-level restrictions to limit exposure of the affected component. Avoid using affected versions if possible.