CVE-2026-120447
Received Received - Intake

Authentication Bypass in HotGo via SMS Code Manipulation

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120447

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bufanyun HotGo 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in HotGo versions up to 2.15.1. It allows unauthenticated attackers to set a known SMS login verification code by sending a Code field to /admin/sms/send. Attackers with a user's mobile number can then use this code to log in via /admin/site/mobileLogin and take over accounts, including administrator accounts.

Detection Guidance

Check for unauthorized access attempts to /admin/sms/send or /admin/site/mobileLogin endpoints. Monitor logs for repeated SMS login requests or failed verification attempts from unknown sources.

Impact Analysis

If you use HotGo, attackers could gain unauthorized access to your accounts, including admin accounts, by exploiting this flaw. This could lead to data theft, unauthorized actions, or complete system compromise if they know your mobile number.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using HotGo may face compliance failures, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update HotGo to version 2.15.1 or later. Disable SMS-based login if not required. Implement rate limiting on SMS endpoints and enforce strong authentication methods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...