---
id: "CVE-2026-116007"
kind: "vulnerability"
aliases: ["CVE-2026-116007"]
title: "ruoyi-vue-pro: SMS login code check lacks limit on guess attempts"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "ruoyi-vue-pro", "self-hosted", "spring-boot"]
not_affected_if: ["no-sms-verification", "sms-login-disabled"]
published_at: "2026-10-25T04:17:34+00:00"
first_seen_at: "2026-10-25T04:36:01+00:00"
updated_at: "2026-10-25T04:43:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116007", "first_seen_at": "2026-10-25T04:36:01+00:00"}]
---

# ruoyi-vue-pro: SMS login code check lacks limit on guess attempts

The SMS verification code check in ruoyi-vue-pro does not limit how many wrong codes can be tried. An attacker who can reach the endpoint can keep guessing codes until one matches, which can log them in as another user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look in `service/sms/SmsCodeServiceImpl.java` for the `validateSmsCode0` method and check whether it counts failed attempts and locks out after a limit.
- Check the project version: unknown if the sources do not say which release is current.

## Timeline

- 2026-10-25T04:36:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116007

## From the sources

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_