CVE-2026-116006

waiting for further signals

GHSA-jwvr-26h4-vc23 ↗EUVD-2026-109334 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

YunaiV ruoyi-vue-pro 2026.09

ETK-2026-2578, permanent identifier

cvss7.3cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5h 57msince last run

16mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+3h41m

+2h

+6h

+8h

+10h

+12h

description

ruoyi-vue-pro through version 2026.09 is affected in its SMS code verification handling. A remote attacker may bypass intended authentication checks by manipulating submitted mobile-number and verification-code values; no prior authentication is stated as required.

mitigation

Restrict network access to the affected SMS verification endpoints to trusted clients and monitor them for anomalous authentication activity. Obtain and apply an upstream-supported update when a fixed release is published.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

16m

cve.org record, t = 0

2026-10-25 03:30Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-25 03:30Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-jwvr-26h4-vc23
2026-10-25 03:30Z
cve.org record for CVE-2026-116006
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-116006

this entry in the feed

GET /api/v1/feed/CVE-2026-116006

{
  "etk_id": "ETK-2026-2578",
  "cve_id": "CVE-2026-116006",
  "display_id": "CVE-2026-116006",
  "ghsa_id": "GHSA-jwvr-26h4-vc23",
  "euvd_id": "EUVD-2026-109334",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authentication in ruoyi-vue-pro SMS verification",
  "summary": "ruoyi-vue-pro through version 2026.09 is affected in its SMS code verification handling. A remote attacker may bypass intended authentication checks by manipulating submitted mobile-number and verification-code values; no prior authentication is stated as required.",
  "mitigation": "Restrict network access to the affected SMS verification endpoints to trusted clients and monitor them for anomalous authentication activity. Obtain and apply an upstream-supported update when a fixed release is published.",
  "vendor": "YunaiV",
  "product": "ruoyi-vue-pro",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2026.09"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ruoyi-vue-pro",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.166645383333332,
  "t0_at": "2026-10-25T03:30:25.691000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-25T03:30:25.691000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T03:30:25.691000+00:00",
      "url": "https://github.com/advisories/GHSA-jwvr-26h4-vc23"
    }
  }
}

published 2026-10-25 06:54Z
last change 2026-10-25 12:57Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.