HotGo (<= 2.15.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hotgo--2.15.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 17:49:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHotGo: Authentication bypass vulnerability (CVE-2026-120447)https://feed.craftedsignal.io/briefs/2026-11-hotgo-auth-bypass/Mon, 02 Nov 2026 17:49:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hotgo-auth-bypass/HotGo versions up to 2.15.1 contain an authentication bypass vulnerability allowing unauthenticated attackers to hijack user and administrator accounts via a predictable SMS verification code.HotGo through version 2.15.1 is affected by an authentication bypass vulnerability. An attacker can manipulate the SMS login process by supplying a user-defined value in the Code field during a request to the /admin/sms/send endpoint. By knowing a target user's mobile number, an attacker can set a known verification code and subsequently authenticate through the /admin/site/mobileLogin endpoint to compromise the account.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to any user account, including those with administrative privileges, resulting in full account takeover.

Recommendation

Identify all HotGo deployments within the environment. As of this report, no specific patch version is listed, but users should monitor the vendor for a security update to address CVE-2026-120447 and apply it immediately upon release.

]]>highadvisory