Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck
CVE-2026-120447HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
High 8.1
In plain English
A high-severity improper authentication in HotGo from bufanyun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 55.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/bufanyun/hotgo/issues/240 issue-tracking
- https://github.com/bufanyun/hotgo/commit/cb57056c746650e6ff86dec1e97d404b63dcfd30 patch
- https://vul.yulun.ac.cn/20261102/hotgo/ exploit
- https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/logic/sys/sms_log.go technical-description
- https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/model/input/sysin/sms_log.go technical-description
- VulnCheck Advisory: HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code third-party-advisory