CVE-2026-107830 Details
Description
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
A vulnerability exists in Jivejdon versions from commit e0306088 to ee67a65e, where the /account/smsVRAction endpoint lacks proper rate limiting. This endpoint, managed by the SmsQQAction class, is accessible without authentication, allowing unlimited SMS messages to be sent. Attackers can exploit this by first loading the newAccount.jsp page to set necessary session attributes, and then repeatedly calling the SMS verification endpoint. This abuse can harass individuals by sending excessive messages to their phone numbers, while also depleting the targeted operator's Tencent Cloud SMS balance.
Users can update to the latest version of Jivejdon, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq jivejdon | >= e0306088, <= ee67a65e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |