ruoyi-vue-pro CVE-2026-116006

Exploitation requires that the target deployment exposes the SMS Code Verification authentication flow implemented in AuthController.java; the attacker manipulates the 'mobile' and/or 'code' request parameters to subvert the verification logic. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no elevated privileges are needed, and the attack is remote over the network against the exposed endpoint. The practical limiting factors are that the affected SMS-login/verification feature must be enabled and reachable, the installation must be running the vulnerable code path (ruoyi-vue-pro up to 2026.09), and the realized impact is bounded (Low confidentiality/integrity/availability); the precise trigger condition is not detailed in the available sources, and the public PoC is unverified.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable flaw requiring no privileges, no user interaction, and low attack complexity, which is why it is network-exploitable against the SMS code verification flow; however, the impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L, SC/SI/SA:N), yielding a base score of 5.5 (Medium). The exploit maturity sub-metric is E:P (proof-of-concept), consistent with the input signal that a public PoC reference exists but is not verified as working exploit code. No EPSS probability is provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active, widespread exploitation - the vuln.today decision label is 'this_month', indicating routine scheduled remediation rather than act_now/emergency urgency. The main tension in the data is a low-privilege network vector paired with uniformly Low impact: an authentication-bypass weakness (CWE-287) could in principle be more damaging, but the available scoring caps each impact dimension at Low, and the mechanism of the bypass is not detailed in the sources. The vendor (YunaiV) was contacted but did not respond, so no vendor advisory or fixed version is available to independently confirm scope.

A remote, unauthenticated attacker interacts with the application's SMS code verification endpoint (AuthController.java) and manipulates the 'mobile' and/or 'code' parameters to defeat the verification check, achieving improper authentication without a valid one-time code. A public PoC reference exists (a GitHub gist) but it is not verified as working exploit code, so reliability is unconfirmed. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the request can be sent directly over the network with no privileges or victim interaction.