CVE-2026-50561
Received Received - Intake

Authentication Bypass in Yuxi Knowledge Base Platform

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment instance or local testing environment to be used to access the backend management interfaces of a different affected instance. An attacker who obtains or constructs an acceptable administrator Authorization token may bypass normal login authentication and gain administrator privileges. This vulnerability could allow an attacker to access system configurations, invoke backend management APIs, create administrator accounts, and ultimately take over the system backend. This issue has been fixed in version 0.6.2. Before upgrading, users are advised to implement the following temporary measures: Set the environment variable `JWT_SECRET_KEY` to a non-default value, and configure a unique, sufficiently strong JWT/authentication key for each deployment instance; and/or avoid exposing backend management interfaces directly to the public network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-50561
EUVD
EUVD-2026-57220

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xerrors yuxi to 0.6.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50561 is an authentication bypass vulnerability in the Yuxi project. The system fails to properly validate administrator tokens in the Authorization header beyond basic format checks. This allows tokens generated in one deployment or local test environment to be reused on other affected instances, bypassing normal login authentication.

Detection Guidance

Check for unauthorized access to backend management interfaces by monitoring logs for requests to endpoints like /api/system/config or /api/auth/users. Look for admin tokens being reused across instances. Verify if JWT_SECRET_KEY is set to a default or shared value across deployments.

Impact Analysis

An attacker who obtains or constructs a valid administrator token could gain full administrative privileges. This includes accessing system configurations, invoking backend management APIs, creating new administrator accounts, and potentially taking over the entire system backend.

Mitigation Strategies

Upgrade to version 0.6.2 or later. Set a unique, strong JWT_SECRET_KEY for each deployment instance. Avoid exposing backend management interfaces to the public network. Temporarily restrict access to sensitive endpoints until mitigation is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart