Threats tagged 'ghsa-529h-x3v3-53h3'

A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component, specifically the SmsCodeServiceImpl.validateSmsCode0 function. This flaw allows improper restriction of excessive authentication attempts, potentially enabling attackers to bypass rate limiting on SMS code validation. The attack requires high complexity and no privileges, with no user interaction needed. Exploit code has been published, but exploitation is considered difficult. The vendor has not responded to the disclosure. The CVSS score is 3.7, indicating low severity.