CVE-2026-94257

Name of the Vulnerable Software and Affected Versions SMS Alert versions 3.9.6 through 4.0.0

Description An issue exists in the OTP (One-Time Password) password reset process where the system fails to bind the account undergoing a password change to the phone number that was verified. This allows unauthenticated attackers to set a new password for any arbitrary account, including those with administrator privileges, by verifying a one-time code sent to a phone number under their own control.

Recommendations Update SMS Alert to version 4.0.1 or later.