This store requires javascript to be enabled for some features to work correctly.
YoSmart Security Advisory
YOSMART-SA-2026-001
Published: 2026-09-16
Last Updated: 2026-09-16
Severity: Medium
1. Summary
YoSmart received a report of an authorization vulnerability affecting the Raedius platform. The vulnerability could allow an unauthenticated remote attacker to retrieve subscription and project metadata belonging to another tenant.
YoSmart investigated the report and resolved the issue in Raedius version 2.2.5.4, deployed on August 6, 2026. The remediation included strengthened project-level authorization and changes to the affected authentication and credential-handling mechanisms.
2. Vulnerability Details
Affected Product: YoSmart Raedius (Cloud Hosted / SaaS)
Affected Versions: 2.0.6 through 2.2.5.3, inclusive
Fixed Version: 2.2.5.4
Primary Affected Component: GET /api/project/{projectId}/plan
Vulnerability Type: Cross-Tenant Authorization Bypass
CWE: CWE-639 — Authorization Bypass Through User-Controlled Key
Severity: Medium
CVSS v3.1 Base Score: 5.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Status: Resolved
Description:
The Raedius subscription-plan API did not adequately verify that the requesting principal was a member of, or otherwise authorized to access, the requested project.
An unauthenticated remote attacker could use reusable OAuth client credentials exposed in the public Raedius web application's JavaScript bundle to obtain a service bearer token. In combination with predictable or enumerable project identifiers, this could allow the attacker to retrieve subscription metadata for projects belonging to other tenants.
The demonstrated attack chain also involved the client_credentials token endpoint and the GET /api/user/getAccount API. Exploitation did not require an existing user account or interaction by the affected user.
Impact:
Successful exploitation could disclose project identifiers and codes, subscription plan type, licensed device allowance, annual subscription fees, issue dates, expiration dates, and service end dates.
The demonstrated vulnerability allowed unauthorized read-only access to subscription and project metadata. No impact on data integrity or service availability was established.
Solution:
YoSmart resolved the vulnerability in Raedius version 2.2.5.4 by disabling the affected client_credentials authentication flow, revoking affected service tokens and credentials, and enforcing project-level authorization before returning subscription-plan data.
Related project-scoped APIs were also reviewed for similar authorization weaknesses.
User Impact:
The remediation was implemented on the Raedius server backend. Users of the YoSmart-hosted Raedius service do not need to install an application or device firmware update for this fix.
Exploitation Status:
YoSmart has not observed any public exploitation or malicious use of this vulnerability prior to the release of this advisory.
3. Solution Summary
| Vulnerability | Affected Component | Solution | User Action Required? |
|---|---|---|---|
| CVE-2026-90649 | Raedius subscription-plan API | Fixed in Raedius version 2.2.5.4 by disabling the affected `client_credentials` authentication flow, revoking affected service tokens and credentials, and enforcing project-level authorization for project-scoped subscription data. | NO |
4. Acknowledgements
YoSmart is committed to the security and integrity of our customers, products, and services. We extend a special thank you to Peter Levashov from SEVERADAO SECURITY LLC (https://www.SeveraDAO.ai) for his valuable contributions and responsible disclosure of this vulnerability.
5. Contact
For any questions regarding this advisory, please contact security@yosmart.com. To learn more about how we handle security reports, please review our Vulnerability Disclosure Policy at https://shop.yosmart.com/pages/security-policy.
6. Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 2026-09-16 | Initial public release |