What is CVE-2026-120447 in HotGo?
CVE-2026-120447 is a high-severity authentication bypass vulnerability affecting HotGo versions 2.8.4 through 2.15.1, carrying a CVSS score of 8.1. This security flaw stems from insufficient authentication checks, classified under CWE-287, which exposes critical endpoints to external tampering.
The issue involves the SMS verification mechanism, similar in risk to other critical flaws like CVE-2026-115905 in Rust, where proper input handling failures lead to severe security compromises across enterprise deployments.
How does the authentication bypass work?
Unauthenticated attackers can exploit this vulnerability by supplying a custom Code field directly to the /admin/sms/send endpoint. By knowing a target user's mobile number, an attacker can dictate the verification code and subsequently sign in via /admin/site/mobileLogin.
This type of logic flaw allows complete account takeover, granting malicious actors full administrative privileges over vulnerable instances without requiring prior system access.
How can I protect my system?
Administrators and development teams managing HotGo instances must apply immediate updates or patches to protect their environments against unauthorized access and potential privilege escalation, keeping parallels with CVE-2026-58946 privilege escalation vulnerabilities.
Ensure that input validation for verification codes is strictly enforced on the server side rather than accepting parameters directly from client requests.