CVE-2026-120447— HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

Quick assessment

Affected

bufanyun HotGo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HotGo through 2.15.1 存在一个身份验证绕过漏洞，允许未认证的攻击者通过向接口提供字段来指定短信登录验证码。若攻击者知晓某用户的手机号码，即可设置一个已知验证码，并通过接口登录，从而接管包括管理员在内的用户账户。

CVSS 8.1 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
bufanyun	HotGo	`≤ 2.15.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

Source: CVE Program / CVE List V5

Vulnerability Description

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bufanyun	HotGo	2.8.4 ~ 2.15.1	-

II. Public POCs for CVE-2026-120447

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120447

请登录查看更多情报信息。

Other References for CVE-2026-120447 (6)

https://github.com/bufanyun/hotgo/issues/240 issue-tracking
https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/logic/sys/sms_log.go technical-description
https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/model/input/sysin/sms_log.go technical-description
https://vul.yulun.ac.cn/20261102/hotgo/ exploit
https://github.com/bufanyun/hotgo/commit/cb57056c746650e6ff86dec1e97d404b63dcfd30 patch
https://www.vulncheck.com/advisories/hotgo-through-2.15.1-authentication-bypass-via-client-set-sms-verification-code third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120447

IV. Related Vulnerabilities

Same product: HotGo

Same vendor: bufanyun

Same weakness: CWE-287