---
id: "CVE-2026-116006"
kind: "vulnerability"
aliases: ["CVE-2026-116006"]
title: "ruoyi-vue-pro: SMS code check in AuthController can be bypassed remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "ruoyi-vue-pro", "self-hosted", "spring"]
not_affected_if: ["no-sms-login", "patched-copy"]
published_at: "2026-10-25T04:17:34+00:00"
first_seen_at: "2026-10-25T04:36:01+00:00"
updated_at: "2026-10-25T04:36:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116006", "first_seen_at": "2026-10-25T04:36:01+00:00"}]
---

# ruoyi-vue-pro: SMS code check in AuthController can be bypassed remotely

The SMS verification-code check in the AuthController.java file of ruoyi-vue-pro, a Java admin framework, accepts a mobile and code pair without proper authentication. A remote attacker can use this to log in as another account, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `AuthController.java` in the project and check how the SMS login or verification endpoint validates the `mobile` and `code` arguments
- Confirm the project version: unknown whether `2026.09` or earlier is in use beyond the affected range given by the source

## Fix

- unknown: the sources name no fixed version and the vendor did not respond
- Until a fix exists, disable the SMS login endpoint or put it behind a check the team controls

## Timeline

- 2026-10-25T04:36:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116006

## From the sources

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_