CVE-2026-50561

Name of the Vulnerable Software and Affected Versions Yuxi versions prior to 0.6.2

Description The authentication mechanism fails to sufficiently validate the identity token within the Authorization header, performing only a validity check. This flaw allows an administrator token generated in a different deployment instance or local testing environment to be used to access the backend management interfaces of another instance. An attacker with a valid administrator Authorization token can bypass login authentication to gain administrator privileges, enabling access to system configurations, invocation of backend management APIs, and the creation of administrator accounts, which may lead to a full system backend takeover.

Recommendations Update to version 0.6.2. Set the environment variable JWT SECRET KEY to a non-default, unique, and strong value for each deployment instance. Avoid exposing backend management interfaces directly to the public network.