An authentication bypass exists that allows unauthenticated attackers to set a custom SMS login verification code. By providing a specific value to the `Code` field at the '/admin/sms/send' endpoint, an attacker who knows a user's mobile number can define the verification code and subsequently use it at the '/admin/site/mobileLogin' endpoint to take over accounts, including those with administrator privileges.