CVE-2026-116007
Deferred Deferred - Pending Action

Improper Authentication in RuoYi-Vue-Pro SMS Code Verification

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116007
EUVD
EUVD-2026-109335

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
YunaiV ruoyi-vue-pro 2026.09
zhijiantianya ruoyi-vue-pro 2026.09

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-799 The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116007 is a flaw in the ruoyi-vue-pro system where the SMS code verification function lacks proper restrictions on authentication attempts. This allows attackers to perform brute force attacks on SMS verification codes without limits, potentially bypassing authentication and gaining admin access.

Detection Guidance

Check for excessive failed SMS verification attempts in logs, particularly for the login endpoint (scene=21). Monitor for repeated requests to /service/sms/SmsCodeServiceImpl.validateSmsCode0 without rate limiting enforcement. Look for admin account login attempts using brute-forced verification codes.

Impact Analysis

This vulnerability enables unauthenticated attackers to guess SMS verification codes and gain full admin account access. Attackers can exploit the 10-minute validity window of codes, brute force a 4-digit code, and obtain an access token to take over admin accounts.

Mitigation Strategies

Implement a failed-attempt counter with account lockout after a threshold (e.g., 5 attempts). Invalidate SMS codes after repeated failures. Enforce CAPTCHA for all SMS login scenarios. Add rate limiting to the verification endpoint to prevent brute force attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart