Threats tagged 'ghsa-c3f7-678j-f69g'

HotGo versions through 2.15.1 have an authentication bypass vulnerability that allows unauthenticated attackers to specify the SMS login verification code via the /admin/sms/send endpoint. An attacker who knows a user's mobile number can set a known code and then log in through /admin/site/mobileLogin, potentially taking over user accounts, including administrator accounts.