{"id":"CVE-2026-116006","kind":"vulnerability","aliases":["CVE-2026-116006"],"related":[],"title":"ruoyi-vue-pro: SMS code check in AuthController can be bypassed remotely","description":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The SMS verification-code check in the AuthController.java file of ruoyi-vue-pro, a Java admin framework, accepts a mobile and code pair without proper authentication. A remote attacker can use this to log in as another account, and the exploit is public.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","ruoyi-vue-pro","self-hosted","spring"],"not_affected_if":["no-sms-login","patched-copy"],"how_to_check":"- Look for `AuthController.java` in the project and check how the SMS login or verification endpoint validates the `mobile` and `code` arguments\n- Confirm the project version: unknown whether `2026.09` or earlier is in use beyond the affected range given by the source","fix":"- unknown: the sources name no fixed version and the vendor did not respond\n- Until a fix exists, disable the SMS login endpoint or put it behind a check the team controls","status":"open","published_at":"2026-10-25T04:17:34+00:00","first_seen_at":"2026-10-25T04:36:01+00:00","triaged_at":"2026-10-25T04:36:56+00:00","updated_at":"2026-10-25T04:36:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:36:56Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources name no fixed version and the vendor did not respond\n- Until a fix exists, disable the SMS login endpoint or put it behind a check the team controls","reach":"internet","title":"ruoyi-vue-pro: SMS code check in AuthController can be bypassed remotely","impact":"high","summary":"The SMS verification-code check in the AuthController.java file of ruoyi-vue-pro, a Java admin framework, accepts a mobile and code pair without proper authentication. A remote attacker can use this to log in as another account, and the exploit is public.","category":"package","nicknames":[],"who_cares":["java","spring","ruoyi-vue-pro","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker logs in as another user remotely without credentials","analyst_note":"Find the vendor or NVD references for the fixed version and confirm whether the SMS login endpoint is exposed by default.","how_to_check":"- Look for `AuthController.java` in the project and check how the SMS login or verification endpoint validates the `mobile` and `code` arguments\n- Confirm the project version: unknown whether `2026.09` or earlier is in use beyond the affected range given by the source","needs_analyst":true,"not_affected_if":["no-sms-login","patched-copy"],"who_is_affected":"Teams running the ruoyi-vue-pro project (YunaiV/zhijiantianya) at versions up to 2026.09 that expose the SMS code login or verification endpoint in AuthController. Deployments that do not use SMS login, or that have their own patched copy, are likely not exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3362,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116006':16A,19A '-2026':15A,18A '2026.09':87C 'accept':49B 'account':69B 'admin':47B 'affect':89C 'anoth':68B 'argument':109C 'attack':60B,116C 'authcontrol':9A 'authcontroller.java':38B,98C 'authent':57B,114C 'bypass':12A 'check':7A,35B 'code':6A,34B,53B,103C 'compon':101C 'contact':133C 'cve':14A,17A 'detect':78C 'disclosur':137C 'earli':134C 'element':90C 'exploit':72B,122C 'file':39B,97C 'framework':48B 'function':94C 'host':28B 'improp':113C 'java':20B,46B 'launch':119C 'log':65B 'manipul':106C 'may':127C 'mobil':51B 'mobile/code':110C 'packag':21B 'pair':54B 'pro':4A,25B,44B,84C 'proper':56B 'public':74B,125C 'remot':13A,59B,120C 'respond':141C 'result':111C 'ruoyi':2A,23B,42B,82C 'ruoyi-vue-pro':1A,22B,41B,81C 'self':27B 'self-host':26B 'sms':5A,31B,102C 'spring':29B 'unknown':93C 'use':62B,129C 'vendor':131C 'verif':33B,104C 'verification-cod':32B 'vue':3A,24B,43B,83C 'vulner':76C 'way':144C 'without':55B 'yunaiv/zhijiantianya':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running the ruoyi-vue-pro project (YunaiV/zhijiantianya) at versions up to 2026.09 that expose the SMS code login or verification endpoint in AuthController. Deployments that do not use SMS login, or that have their own patched copy, are likely not exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T04:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116006","severity":null,"published_at":"2026-10-25T04:17:34+00:00","modified_at":"2026-10-25T04:17:34+00:00","first_seen_at":"2026-10-25T04:36:01+00:00","fetched_at":"2026-10-25T04:36:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}