high advisory November 2, 2026

HotGo: Authentication bypass vulnerability (CVE-2026-120447)

HotGo versions up to 2.15.1 contain an authentication bypass vulnerability allowing unauthenticated attackers to hijack user and administrator accounts via a predictable SMS verification code.

Triage facts

Revision 1

Applicability: HotGo (<= 2.15.1)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 2, 17:49 UTC
Detection: 1 rule
Vulnerabilities: 1 CVE
Source quality: A1Likely

HotGo through version 2.15.1 is affected by an authentication bypass vulnerability. An attacker can manipulate the SMS login process by supplying a user-defined value in the Code field during a request to the /admin/sms/send endpoint. By knowing a target user's mobile number, an attacker can set a known verification code and subsequently authenticate through the /admin/site/mobileLogin endpoint to compromise the account.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to any user account, including those with administrative privileges, resulting in full account takeover.

Recommendation

Identify all HotGo deployments within the environment. As of this report, no specific patch version is listed, but users should monitor the vendor for a security update to address CVE-2026-120447 and apply it immediately upon release.

Immediate actions

Inventory all instances of HotGo in the environment

IT Operations 24h

Mitigations

Disable the /admin/sms/send endpoint or restrict access until a security patch is available

immediate IT Operations

CVE-2026-120447

Detection coverage 1

Detect CVE-2026-120447 Exploitation - Authentication Bypass via SMS Code Manipulation

high

Detects exploitation attempts where an attacker explicitly provides a Code parameter to the /admin/sms/send endpoint

sigma tactics: initial_access techniques: T1078, T1556 sources: webserver

Detection queries are available on the platform. Get full rules →