CVE-2026-116006: YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can target the SMS Code Verification functionality. No user interaction or prior privileges are required.
What inputs are involved in the vulnerable behavior?
The issue is triggered through manipulation of the mobile and code arguments handled by AuthController.java in the SMS Code Verification component.
Are affected deployments exposed by default?
The available information does not state whether the SMS Code Verification functionality is enabled or reachable in default deployments.
How urgent is remediation?
The issue is rated high severity with a 7.3 CVSS score, and public exploit information is available. Prioritize updating or otherwise restricting access to the affected SMS verification endpoint.
Which versions are affected?
YunaiV/zhijiantianya ruoyi-vue-pro is reported affected through version 2026.09.