Live › vulnerability › CVE-2026-120447
HotGo through version 2.15.1 accepts a Code field on its SMS send endpoint, so an attacker can choose the login code. Knowing a user's mobile number is enough to sign in as that user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
HotGo deployments at version 2.15.1 or earlier that expose the admin SMS login path to the internet. The sources describe no requirement beyond knowing a user's mobile number, so any reachable instance with SMS login is exposed. Instances that do not run HotGo can skip it.
No product ranges from the sources yet.
2.15.1 are described as affected./admin/sms/send endpoint and whether it accepts a Code field from requests.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-120447")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.