EUVD-2026-115207
GHSA-c3f7-678j-f69g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain target's registered mobile number
-
DeliveryPOST to /admin/sms/send with chosen Code
-
ExploitServer stores attacker-known verification code
-
ExecutionSubmit code to /admin/site/mobileLogin
-
PersistAuthenticate as victim/admin
-
ImpactFull account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the HotGo SMS/mobile login flow is in use and that the attacker knows the victim's registered mobile number (the AT:P attack requirement) - this is the primary limiting factor and makes the attack targeted rather than spray-and-pray. On vulnerable versions (through 2.15.1), no authentication, privileges, or user interaction are needed: the /admin/sms/send endpoint accepts a client-controlled Code field, letting the attacker fix the SMS verification code, which is then replayed to /admin/site/mobileLogin. The fix always generates a server-side random code and stops serializing the client Code, so patched instances remove the prerequisite entirely. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) and the source evidence agree: pre-patch code in sms_log.go used a client-supplied Code when provided ( |
| Exploit ScenarioDerived | An attacker who knows a HotGo user's (or administrator's) registered mobile number sends a request to /admin/sms/send that includes a Code field, forcing the server to store an attacker-chosen verification code instead of a random one. The attacker then submits that same code to /admin/site/mobileLogin and is logged in as the victim, taking over the account. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Account takeover in HotGo through 2.15.1 is possible because the /admin/sms/send handler honours a client-supplied Code field instead of always generating a server-side SMS verification code, letting an attacker pin a code they already know and replay it against /admin/site/mobileLogin. Unauthenticated remote attackers who know a victim's registered mobile number can sign in as that user, including administrators, with high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code; there is no CISA KEV entry, exploitation is gated by the need to know the target's mobile number and by the SMS/mobile login flow being enabled, and the vendor has published an upstream fix - priority is act_now.
RemediationAI
Apply the upstream fix commit https://github.com/bufanyun/hotgo/commit/cb57056c746650e6ff86dec1e97d404b63dcfd30 (or any later build containing it); the change makes SendCode always generate a server-side random code and stops the Code field from being bound or serialized from client input, which removes the prerequisite entirely. No tagged patched release version is confirmed in the available data, so verify the commit is present in the build you deploy rather than assuming a version number. If the system cannot be rebuilt immediately, the effective compensating control follows directly from the root cause: block or strip client-supplied code parameters on the SMS send path at a reverse proxy or WAF, or disable the SMS/mobile login flow (/admin/sms/send and /admin/site/mobileLogin) until the patch is in place - the trade-off is that mobile-number login stops working and users must fall back to password authentication, so confirm an alternative login path and admin recovery method exist before disabling it. After patching, review SMS send and mobile-login logs for requests that carried an explicit verification code, and reset credentials or sessions for accounts that may have been accessed that way. Refer to the vendor issue and the VulnCheck advisory for the authoritative fix description.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HotGo (bufanyun/hotgo) is a Go-based admin/back-office framework built on the GoFrame (gogf/gf v2) toolkit. The flawed flow lives in the SMS log logic: SendCode in server/internal/logic/sys/sms_log.go generated a random four-digit code with grand.Digits(4) only when the incoming Code value was empty, otherwise it accepted whatever the caller supplied. The request model in server/internal/model/input/sysin/sms_log.go bound that value from JSON (a writable code field on the SMS send input), so an unauthenticated HTTP client could dictate the verification code that the server associated with a mobile number. CWE-287 (Improper Authentication) is the right classification: the authentication decision for mobile login is based on a secret that the unauthenticated requester itself chose, collapsing the second factor of the mobile-login flow into attacker-controlled data. The upstream fix does two things in tandem - SendCode now unconditionally overwrites the incoming value with grand.Digits(4), and the Code field's JSON tag is changed to '-' so it is no longer bound from or serialized to client requests. Because the CVSS 4.0 vector carries AT:P, the practical prerequisite is knowledge of the victim's registered mobile number plus use of the SMS/mobile login path; no privileges or user interaction are required (PR:N/UI:N).
Know when Hotgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated request sets a known SMS code (PR:N/UI:N/AV:N/AC:L); account/admin takeover gives full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
Technical POC Analysis
CWE-287 authentication bypass.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical-severity flaw in the HotGo platform (up to version 2.15.1) allows unauthenticated attackers to hijack accounts-including administrator accounts-simply by knowing a victim's registered mobile number. This undermines the integrity of the authentication system across anyone using HotGo's SMS/mobile login, exposing the organization to full administrative compromise, data exposure, and service disruption. Leadership should prioritize remediation because administrative takeover carries organization-wide consequences that are not contained to a single user.
Apply vendor patch. Until patched, disable the SMS/mobile login flow (or the /admin/sms/send and /admin/site/mobileLogin endpoints) if not essential, restrict admin interface access to trusted networks, and enforce multi-factor authentication and monitoring on administrator accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB