CVE-2026-120447: HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
Published Nov 2, 2026
·Updated
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
Other sources
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
— OSV
Event History
Nov 2, 2026
CVE Published
via OSV·02:29 PM
Data Sourced
via OSV·02:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness