CVE-2026-116006
Deferred Deferred - Pending Action

Authentication Bypass in RuoYi-Vue-Pro via SMS Code

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116006
EUVD
EUVD-2026-109334

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
YunaiV ruoyi-vue-pro 2026.09
zhijiantianya ruoyi-vue-pro 2026.09

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116006 is a critical authentication bypass vulnerability in the ruoyi-vue-pro (Yudao) system. It stems from a hardcoded SMS verification code of '9999' in the default configuration. This allows unauthenticated attackers to reset admin passwords or gain full admin access via SMS login without needing credentials, CAPTCHA, or SMS delivery.

Detection Guidance

Check the application.yaml configuration file for a hardcoded SMS verification code of '9999' in the ruoyi-vue-pro system. Verify if the SMS code generation uses a predictable value instead of secure random generation.

Impact Analysis

Attackers can remotely exploit this to gain full admin access to the system, bypassing authentication entirely. They can reset passwords, access sensitive data, or perform unauthorized actions. The attack requires no user interaction or credentials, making it highly dangerous for systems using this framework.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict authentication and data protection measures, while HIPAA requires secure access to protected health information. The lack of proper authentication and potential data exposure could lead to non-compliance and legal consequences.

Mitigation Strategies

Remove the hardcoded SMS code '9999' from the configuration. Replace it with a secure random code generation mechanism. Enforce CAPTCHA or additional authentication controls for privileged accounts like admin.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart