CVE-2026-116007 Details
Description
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 in the SMS code verification feature. The issue arises in the SmsCodeServiceImpl.validateSmsCode0 method, where there is no limit on failed authentication attempts. This flaw allows for unauthenticated brute force attacks on the SMS verification code, potentially leading to unauthorized access to user accounts, including the admin account.
To address this vulnerability, implement a failed-attempt counter with a lockout feature for SMS code verification. Additionally, ensure that every failed attempt is recorded, either in a database or using Redis, and consider invalidating or shortening the validity period of a code after repeated failed attempts. It is also recommended to provide a CAPTCHA option for all SMS code sending scenarios, not just password resets.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Fulucky0-yuri/63e3a697ec79ffd41c1cbfdbb1fcd5b4 | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-116007 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/993200 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426104 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426104/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YunaiV ruoyi-vue-pro | master master-jdk17 master-jdk25 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |