JWT Authentication Bypass via Mock Token Manipulation

A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in improper authentication. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7710 is an improper authentication vulnerability affecting YunaiV yudao-cloud versions up to 3.8.0, specifically in the JwtAuthenticationTokenFilter.java component of Ruoyi-Vue-Pro. By manipulating the mock-token argument in the doFilterInternal function, attackers can bypass JWT authentication controls entirely, gaining unauthorized access to protected resources. This is particularly critical because the exploit is publicly disclosed with no vendor response, making it an active threat to any organization running vulnerable versions. Organizations using this cloud platform should treat this as a high-priority remediation target, as authentication bypass vulnerabilities directly enable account takeover, unauthorized data access, and lateral movement within systems.

Casky's 261 mapped skills detect the attack patterns behind this CVE by identifying the two key MITRE ATT&CK techniques: Initial Access (TA0004) and Credential Access (TA0006). Claude AI's extended reasoning traces how attackers exploit improper authentication validation to establish initial footholds without valid credentials, then use those compromised sessions to access sensitive resources and escalate privileges. Practitioners using Casky would see findings highlighting anomalous authentication token patterns, suspicious mock-token parameter usage, JWT validation failures, and unauthorized API calls from unauthenticated or invalidly authenticated sessions. The platform's skill mapping would correlate these detection signals across your security infrastructure—from WAF logs showing token manipulation attempts to IAM systems recording impossible travel scenarios and unusual resource access patterns—enabling your team to rapidly identify and contain exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7710.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-7710

Casky has 261 skills that investigate the attack patterns behind CVE-2026-7710. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn