CVE-2026-120447

{
  "etk_id": "ETK-2026-3297",
  "cve_id": "CVE-2026-120447",
  "display_id": "CVE-2026-120447",
  "ghsa_id": "GHSA-c3f7-678j-f69g",
  "euvd_id": "EUVD-2026-115207",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in bufanyun HotGo SMS login",
  "summary": "HotGo through version 2.15.1 is affected by an authentication bypass in its SMS-based login flow. An unauthenticated attacker who knows a target user's mobile number may be able to take over that account, including an administrator account.",
  "mitigation": "Restrict public access to the affected SMS login and administration endpoints until an upstream update or verified vendor fix is available. Limit access to trusted networks and monitor for unexpected SMS-login activity.",
  "vendor": "bufanyun",
  "product": "HotGo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.15.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "HotGo",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.37110318333333,
  "t0_at": "2026-11-02T14:29:06.746000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T14:29:06.746000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T14:29:06.746000+00:00",
      "url": "https://github.com/advisories/GHSA-c3f7-678j-f69g"
    }
  }
}