CVE-2026-120447

Name of the Vulnerable Software and Affected Versions HotGo versions 2.0.0 through 2.15.1

Description An authentication bypass exists that allows unauthenticated attackers to set a custom SMS login verification code. By providing a specific value to the Code field at the '/admin/sms/send' endpoint, an attacker who knows a user's mobile number can define the verification code and subsequently use it at the '/admin/site/mobileLogin' endpoint to take over accounts, including those with administrator privileges.

Recommendations Update HotGo to a version later than 2.15.1. Restrict access to the '/admin/sms/send' and '/admin/site/mobileLogin' endpoints to minimize the risk of exploitation.