Authorization Bypass via User-Controlled Keys in Yaay App

Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Media App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Yaay Social Media App: from 3.8.0 through 24102025.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-12008 represents a critical authorization bypass vulnerability in the Yaay Social Media App (versions 3.8.0 through 24102025) where user-controlled keys can circumvent Access Control Lists (ACLs). This CWE-639 vulnerability allows attackers to access functionality and resources that should be restricted to authorized users only. The flaw is particularly concerning because it affects a social media platform with potentially millions of users, exposing sensitive user data, private communications, and account-level functionality to unauthorized access. Any user or unauthenticated attacker could potentially escalate privileges or access restricted features by manipulating authentication or authorization tokens, making this a high-severity threat (CVSS 8.8) requiring immediate patching across all affected versions.

Casky.ai's 261 mapped security skills detect the attack patterns underlying this vulnerability by analyzing indicators across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would observe detection patterns such as: anomalous token manipulation attempts where user-supplied parameters modify authorization contexts; requests with modified or replayed authentication headers; access attempts to protected endpoints using tokens from lower-privileged accounts; and unusual ACL bypass indicators like direct object references with modified identifiers. Claude's extended reasoning capabilities would correlate these behavioral signals—detecting the logical inconsistency between a user's assigned permissions and their actual resource access—to identify authorization bypass attacks before they succeed. Security teams would see these findings surfaced through Casky's skill mappings, enabling rapid incident response and policy enforcement adjustments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-12008.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2025-12008

Casky has 261 skills that investigate the attack patterns behind CVE-2025-12008. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn