CVE-2026-120447 in HotGo
Summary
by MITRE • 11/02/2026
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within HotGo versions prior to 2.15.1 represents a critical authentication bypass flaw that fundamentally undermines the integrity of the SMS-based two-factor authentication mechanism. This issue stems from improper validation and control flow management in the administrative interface's communication with external telecommunication services. Specifically, the endpoint /admin/sms/send is designed to generate and transmit a random verification code via Short Message Service to a specified mobile number for user login verification. However, due to insufficient input sanitization or lack of server-side generation enforcement, an attacker can manipulate this process by directly supplying their own chosen value in the Code field rather than allowing the system to generate a secure, unpredictable token. This design flaw effectively neutralizes the primary security benefit of two-factor authentication, which relies on the unpredictability and secrecy of the verification code sent through a separate channel from the password entry.
The operational impact of this vulnerability is severe, as it allows unauthenticated attackers to perform account takeover attacks against any user whose mobile phone number is known or discoverable within the system. By exploiting the /admin/sms/send endpoint, an attacker can set a predictable verification code and subsequently use that same code at the /admin/site/mobileLogin endpoint to bypass authentication entirely. This capability extends beyond standard user accounts to include administrative privileges, as the vulnerability exists in paths accessible during the login process for all roles. Consequently, attackers with knowledge of an administrator's mobile number can gain full control over the application backend, leading to potential data breaches, unauthorized configuration changes, and complete compromise of the hosting environment. This type of attack is particularly dangerous because it does not require complex exploitation techniques or prior access; it relies solely on information disclosure regarding phone numbers and a straightforward manipulation of API parameters.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically relating to the failure to properly verify credentials during authentication processes. Furthermore, the technique employed by attackers maps directly to MITRE ATT&CK tactic T1078, Valid Accounts, and more specifically the sub-technique of bypassing multi-factor authentication through credential stuffing or manipulation of secondary factors. The ability to dictate the verification code transforms a security control intended to add entropy into a predictable variable that can be easily guessed or pre-set by an adversary. This reflects a broader class of issues where developers assume that providing an API for sending codes inherently secures them, without implementing strict server-side generation and validation logic that prevents client-side manipulation of critical authentication variables.
Mitigation strategies must focus on enforcing server-side control over the entire authentication flow. The most effective remediation is to remove any functionality that allows clients to specify verification codes during the SMS transmission phase. Systems should exclusively generate random, high-entropy tokens internally and transmit them without exposing the generation mechanism or allowing parameter override via API inputs. Additionally, implementing rate limiting on both the /admin/sms/send and login endpoints can help mitigate brute-force attempts if any residual risk remains. Organizations running HotGo versions earlier than 2.15.1 should upgrade immediately to patch this flaw. In environments where upgrading is not instantly feasible, network-level controls such as Web Application Firewalls (WAFs) can be configured to detect and block requests that attempt to inject custom values into the Code parameter of SMS-related endpoints, although this serves only as a temporary compensating control rather than a permanent fix.