HotGo Let the Client Choose the SMS Login Verification Code
HotGo Let the Client Choose the SMS Login Verification Code An SMS verification code is useful only when the server controls its value and ties it to one login attempt. The GitHub Advisory Database describes CVE-2026-120447 as a HotGo authentication bypass where the client can choose that code. The affected versions are HotGo 2.8.4 through 2.15.1. The advisory rates the issue Critical with a CVSS…
HotGo's authentication process is at risk due to a vulnerability allowing clients to select the SMS login verification code. This issue, described as a critical authentication bypass, affects versions 2.8.4 through 2.15.1 of HotGo. The advisory rates it with a CVSS score of 9.2.
An attacker can exploit this by providing a known code value through a server-controlled field. If they know the user's mobile number, they can complete a login as that user. This vulnerability is not related to SMS delivery; the server accepts the client's chosen code instead of generating a unique one. The trust boundary is broken before the verification code leaves the server.
To exploit this, an attacker requires network access to the affected endpoint and a target mobile number. The exploit does not require user interaction. High-risk areas include public and reseller administration portals, with internal management portals being relevant if an attacker has access to a user station or network. Signs of account takeover include unusual authentication logs, changes in user credentials, and missing audit logs.
To remediate this issue, administrators should upgrade to the hotfix referenced in the advisory. If upgrading isn't possible, disabling SMS login for privileged accounts, requiring a second authentication method, and restricting administration endpoints to trusted networks are advised. Rotating sessions and credentials for potentially compromised accounts is also recommended.
After the fix, it's crucial to verify that the server still ignores the client-supplied code and generates a proper, time-limited code tied to the correct mobile number. This verification is necessary as a patch might only address one login flow while leaving others vulnerable.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
