YunaiV ruoyi-vue-pro: Improper authentication in SMS Code Verification (CVE-2026-116006)
An improper authentication vulnerability in the SMS Code Verification component of ruoyi-vue-pro allows remote attackers to bypass authentication mechanisms by manipulating the mobile or code arguments in AuthController.java.
CVE search metadata
CVE search record: CVE-2026-116006. Severity: high. CVSS: 7.3. KEV: no. Product: ruoyi-vue-pro (<= 2026.09). Brief: YunaiV ruoyi-vue-pro: Improper authentication in SMS Code Verification (CVE-2026-116006). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ruoyi-vue-pro-auth-bypass/
Triage facts
Revision 1- Applicability
- ruoyi-vue-pro (<= 2026.09)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 04:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability exists in the SMS Code Verification component of ruoyi-vue-pro (versions up to 2026.09). An attacker can exploit this remotely by manipulating the mobile or code parameters processed by AuthController.java to perform improper authentication. Public exploit code is available for this vulnerability. The vendor has been unresponsive to disclosure efforts.
Impact
Successful exploitation allows for improper authentication, potentially granting unauthorized access to the application.
Recommendation
- Inventory all instances of ruoyi-vue-pro version 2026.09 or earlier.
- Implement strict rate limiting and monitoring on the SMS code verification endpoint handled by
AuthController.javato detect anomalous authentication attempts. - Prioritize application-level logging for all authentication-related requests, specifically tracking the frequency and validity of SMS verification codes associated with specific mobile numbers.
Immediate actions
Identify and isolate internet-facing instances of ruoyi-vue-pro version 2026.09 or earlier.
Threat Hunt
Hunt for spikes in authentication failures or rapid, sequential code attempts for a single mobile number in application logs.
Data: Application audit logs or web server access logs detailing POST requests to SMS verification endpoints
Mitigations
Apply compensating controls by implementing rate limiting on the SMS verification endpoint.
CVE-2026-116006