RuoYi-Vue-Pro EUVD-2026-109335

Exploitation requires that the application's SMS Code Verification feature is in use and reachable, and targets the validateSmsCode0 path in /service/sms/SmsCodeServiceImpl.java, which does not restrict the number of verification attempts (CWE-307), allowing an attacker to repeatedly submit code guesses for a known phone number. Limiting factors are significant: the CVSS vector and source both rate attack complexity as high (AC:H) and exploitability as 'difficult', because success depends on guessing a short-lived verification code within its validity window; impact is confined to low confidentiality (VC:L) with no integrity or availability effect. Affects ruoyi-vue-pro up to and including 2026.09, and no vendor-confirmed fixed version is available because the vendor did not respond to the disclosure.

This is a low-priority, high-CVSS-it-is-not - the VulDB CVSS 4.0 base score is 2.9 (LOW), and the vuln.today decision label is 'monitor', both pointing to a minor issue rather than an urgent one. The vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) shows a network-reachable, unauthenticated weakness but with high attack complexity (AC:H) and only low confidentiality impact and no integrity or availability impact - consistent with the source's own note that exploitability is 'difficult'. The signals are mutually consistent, not conflicting: a missing rate limit (CWE-307) on SMS-code verification that at most lets an attacker attempt to brute-force a short-lived code. No EPSS score is provided and the CVE is not on CISA KEV, so there is no evidence of active or widespread exploitation; the only exploitation signal is E:P (proof-of-concept) backed by a single gist reference that is not verified as working exploit code. Net assessment: a genuine but low-severity hardening gap, appropriate to track and patch on a normal cycle, not an emergency.

An attacker who knows a target user's phone number repeatedly submits guesses to the SMS-code verification endpoint (SmsCodeServiceImpl.validateSmsCode0), which fails to restrict excessive attempts, hoping to guess a valid code before it expires. Because attack complexity is high and the code's validity window is short, success is difficult and limited to low confidentiality impact (e.g., bypassing SMS verification for one account). A public PoC reference exists on GitHub Gist, but it is not verified as working exploit code.