A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java …

A critical authentication bypass vulnerability has been discovered in YunaiV yudao-cloud up to version 3.8.0. The flaw affects the doFilterInternal function in JwtAuthenticationTokenFilter.java of the Ruoyi-Vue-Pro component. Attackers can manipulate the mock-token argument to bypass authentication controls. The vulnerability allows for remote exploitation and a public exploit has been released. The vendor was contacted but has not responded to the disclosure.