Live › vulnerability › CVE-2026-116007
Go to dashboardThe SMS verification code check in ruoyi-vue-pro does not limit how many wrong codes can be tried. An attacker who can reach the endpoint can keep guessing codes until one matches, which can log them in as another user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 04:36 UTC. All times on this page are UTC.
Deployments of ruoyi-vue-pro up to 2026.09 that use SMS code verification for login or sensitive actions are exposed. The sources do not say whether the vendor has released a fix, and the vendor did not respond to the disclosure. Teams that do not use SMS code login can skip it.
No product ranges from the sources yet.
service/sms/SmsCodeServiceImpl.java for the validateSmsCode0 method and check whether it counts failed attempts and locks out after a limit.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.