Cpe:2.3:a:yunaiv:ruoyi-Vue-Pro:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ayunaivruoyi-vue-pro/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 04:26:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgYunaiV ruoyi-vue-pro: Improper authentication in SMS Code Verification (CVE-2026-116006)https://feed.craftedsignal.io/briefs/2026-10-ruoyi-vue-pro-auth-bypass/Sun, 25 Oct 2026 04:26:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ruoyi-vue-pro-auth-bypass/An improper authentication vulnerability in the SMS Code Verification component of ruoyi-vue-pro allows remote attackers to bypass authentication mechanisms by manipulating the mobile or code arguments in AuthController.java.A vulnerability exists in the SMS Code Verification component of ruoyi-vue-pro (versions up to 2026.09). An attacker can exploit this remotely by manipulating the mobile or code parameters processed by AuthController.java to perform improper authentication. Public exploit code is available for this vulnerability. The vendor has been unresponsive to disclosure efforts.

Impact

Successful exploitation allows for improper authentication, potentially granting unauthorized access to the application.

Recommendation

  • Inventory all instances of ruoyi-vue-pro version 2026.09 or earlier.
  • Implement strict rate limiting and monitoring on the SMS code verification endpoint handled by AuthController.java to detect anomalous authentication attempts.
  • Prioritize application-level logging for all authentication-related requests, specifically tracking the frequency and validity of SMS verification codes associated with specific mobile numbers.
]]>highadvisory