ruoyi-vue-pro SMS Authentication Flaws

Improper authentication in the SMS code verification flow of ruoyi-vue-pro (AuthController.java) lets remote attackers manipulate the 'mobile' and 'code' parameters to subvert login verification, yielding limited confidentiality, integrity and availability impact rather than full account takeover evidence. Versions up to and including 2026.09 are reported affected; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the independent assessment both confirm the attack is network-reachable with no privileges or user interaction, though the SMS login feature must be enabled and exposed for exploitation. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the item is triaged as 'this_month' priority - a genuine but moderate-priority issue rather than a top-tier emergency.

Missing attempt throttling in the SMS code verification logic of ruoyi-vue-pro (through version 2026.09) allows unauthenticated remote attackers to repeatedly submit verification-code guesses for a known phone number, with the only real impact being low confidentiality exposure if a guess lands inside the code's validity window. Attack complexity is rated high and exploitability 'difficult', and the CVSS 4.0 base score is 2.9 (LOW) with a vuln.today decision label of 'monitor'; a public PoC reference exists but is not verified as working exploit code, no CISA KEV entry applies, and the vendor did not respond to the disclosure so no fixed release is confirmed.