{
  "id": 19790739,
  "title": "HotGo Let the Client Choose the SMS Login Verification Code",
  "url": "https://urgent.news/2026/11/13/hotgo-let-the-client-choose-the-sms-login-verification-code",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T10:20:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/hotgo-let-the-client-choose-the-sms-login-verification-code-51ho"
  },
  "original_language": "en",
  "account": "HotGo's authentication process is at risk due to a vulnerability allowing clients to select the SMS login verification code. This issue, described as a critical authentication bypass, affects versions 2.8.4 through 2.15.1 of HotGo. The advisory rates it with a CVSS score of 9.2.\n\nAn attacker can exploit this by providing a known code value through a server-controlled field. If they know the user's mobile number, they can complete a login as that user. This vulnerability is not related to SMS delivery; the server accepts the client's chosen code instead of generating a unique one. The trust boundary is broken before the verification code leaves the server.\n\nTo exploit this, an attacker requires network access to the affected endpoint and a target mobile number. The exploit does not require user interaction. High-risk areas include public and reseller administration portals, with internal management portals being relevant if an attacker has access to a user station or network. Signs of account takeover include unusual authentication logs, changes in user credentials, and missing audit logs.\n\nTo remediate this issue, administrators should upgrade to the hotfix referenced in the advisory. If upgrading isn't possible, disabling SMS login for privileged accounts, requiring a second authentication method, and restricting administration endpoints to trusted networks are advised. Rotating sessions and credentials for potentially compromised accounts is also recommended.\n\nAfter the fix, it's crucial to verify that the server still ignores the client-supplied code and generates a proper, time-limited code tied to the correct mobile number. This verification is necessary as a patch might only address one login flow while leaving others vulnerable.",
  "summary": "HotGo Let the Client Choose the SMS Login Verification Code An SMS verification code is useful only when the server controls its value and ties it to one login attempt. The GitHub Advisory Database describes CVE-2026-120447 as a HotGo authentication bypass where the client can choose that code. The affected versions are HotGo 2.8.4 through 2.15.1. The advisory rates the issue Critical with a CVSS…",
  "key_points": [
    "Clients can choose SMS login verification code in HotGo",
    "Critical authentication bypass vulnerability rated 9.2",
    "Upgrade or disable SMS login for privileged accounts"
  ],
  "editors_take": "Allowing clients to dictate verification codes fundamentally breaks the server-side trust boundary, turning a security measure into an open door for unauthorized account takeovers via simple mobile number targeting.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}