This vulnerability affects the doFilterInternal function in JwtAuthenticationTokenFilter.java within the Ruoyi-Vue-Pro component of YunaiV yudao-cloud up to version 3.8.0. An attacker can manipulate the mock-token argument to bypass authentication controls, resulting in improper authentication. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and no cloud service remediation applies as this is not a cloud service product.

Successful exploitation allows remote attackers to bypass authentication, potentially granting unauthorized access to the affected system. This could lead to unauthorized actions or data exposure depending on the system's configuration and usage. The CVSS score of 6.9 reflects a medium severity impact with partial impact on confidentiality, integrity, and availability. No confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider implementing compensating controls such as restricting access to the affected component or enhancing authentication validation until a patch is released.