CVE-2026-116006 Scanner
CVE-2026-116006 Scanner - Admin Takeover via Predictable SMS Code vulnerability in Ruoyi-Vue-Pro
Used 3 times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-116006
5.5
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
ruoyi-vue-pro
Updated Oct 29, 2026View on NVD →
S4E scanner
CVE history: ruoyi-vue-pro
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →