Live › vulnerability › CVE-2026-116006
Go to dashboardThe SMS verification-code check in the AuthController.java file of ruoyi-vue-pro, a Java admin framework, accepts a mobile and code pair without proper authentication. A remote attacker can use this to log in as another account, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 04:36 UTC. All times on this page are UTC.
Teams running the ruoyi-vue-pro project (YunaiV/zhijiantianya) at versions up to 2026.09 that expose the SMS code login or verification endpoint in AuthController. Deployments that do not use SMS login, or that have their own patched copy, are likely not exposed; the sources do not say more.
No product ranges from the sources yet.
AuthController.java in the project and check how the SMS login or verification endpoint validates the mobile and code arguments2026.09 or earlier is in use beyond the affected range given by the sourceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116006")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.