{"id":"CVE-2026-116007","kind":"vulnerability","aliases":["CVE-2026-116007"],"related":[],"title":"ruoyi-vue-pro: SMS login code check lacks limit on guess attempts","description":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The SMS verification code check in ruoyi-vue-pro does not limit how many wrong codes can be tried. An attacker who can reach the endpoint can keep guessing codes until one matches, which can log them in as another user.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","ruoyi-vue-pro","self-hosted","spring-boot"],"not_affected_if":["no-sms-verification","sms-login-disabled"],"how_to_check":"- Look in `service/sms/SmsCodeServiceImpl.java` for the `validateSmsCode0` method and check whether it counts failed attempts and locks out after a limit.\n- Check the project version: unknown if the sources do not say which release is current.","fix":null,"status":"open","published_at":"2026-10-25T04:17:34+00:00","first_seen_at":"2026-10-25T04:36:01+00:00","triaged_at":"2026-10-25T04:43:19+00:00","updated_at":"2026-10-25T04:43:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:43:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ruoyi-vue-pro: SMS login code check lacks limit on guess attempts","impact":"medium","summary":"The SMS verification code check in ruoyi-vue-pro does not limit how many wrong codes can be tried. An attacker who can reach the endpoint can keep guessing codes until one matches, which can log them in as another user.","category":"package","nicknames":[],"who_cares":["ruoyi-vue-pro","java","spring-boot","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker guesses SMS codes and takes over accounts","analyst_note":"Check the upstream repository for a fix or rate-limit patch to SmsCodeServiceImpl.validateSmsCode0 and whether the vendor has responded.","how_to_check":"- Look in `service/sms/SmsCodeServiceImpl.java` for the `validateSmsCode0` method and check whether it counts failed attempts and locks out after a limit.\n- Check the project version: unknown if the sources do not say which release is current.","needs_analyst":true,"not_affected_if":["sms-login-disabled","no-sms-verification"],"who_is_affected":"Deployments of ruoyi-vue-pro up to 2026.09 that use SMS code verification for login or sensitive actions are exposed. The sources do not say whether the vendor has released a fix, and the vendor did not respond to the disclosure. Teams that do not use SMS code login can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000619,"input_tokens":3421,"output_tokens":554,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116007':16A,19A '-2026':15A,18A '/service/sms/smscodeserviceimpl.java':98C '2026.09':87C 'anoth':72B 'attack':53B,115C,124C 'attempt':13A,113C 'authent':112C 'boot':31B 'caus':107C 'check':8A,36B 'code':7A,35B,48B,62B,103C 'complex':121C 'compon':101C 'contact':146C 'cve':14A,17A 'difficult':133C 'disclosur':150C 'earli':147C 'element':90C 'endpoint':58B 'excess':111C 'exploit':129C,135C 'file':97C 'flaw':75C 'found':78C 'function':93C 'guess':12A,61B 'high':127C 'host':28B 'impact':89C 'improp':108C 'initi':118C 'java':20B 'keep':60B 'lack':9A 'limit':10A,44B 'log':68B 'login':6A 'mani':46B 'manipul':106C 'match':65B 'may':116C,140C 'one':64B 'packag':21B 'pro':4A,25B,41B,84C 'publish':138C 'rather':126C 'reach':56B 'regard':131C 'remot':119C 'respond':154C 'restrict':109C 'ruoyi':2A,23B,39B,82C 'ruoyi-vue-pro':1A,22B,38B,81C 'self':27B 'self-host':26B 'sms':5A,33B,102C 'smscodeserviceimpl.validatesmscode0':94C 'spring':30B 'spring-boot':29B 'tri':51B 'use':142C 'user':73B 'vendor':144C 'verif':34B,104C 'vue':3A,24B,40B,83C 'way':157C 'wrong':47B 'yunaiv/zhijiantianya':80C","nicknames":[],"mitigations":[],"who_affected":"Deployments of ruoyi-vue-pro up to 2026.09 that use SMS code verification for login or sensitive actions are exposed. The sources do not say whether the vendor has released a fix, and the vendor did not respond to the disclosure. Teams that do not use SMS code login can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T04:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116007","severity":null,"published_at":"2026-10-25T04:17:34+00:00","modified_at":"2026-10-25T04:17:34+00:00","first_seen_at":"2026-10-25T04:36:01+00:00","fetched_at":"2026-10-25T04:36:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}