The vulnerability in Jivejdon allows attackers to trigger the /account/smsVRAction endpoint without any authentication or rate limiting. This is a rate‑limiting violation (CWE-799). By repeatedly calling this endpoint, an adversary can send unlimited SMS messages to arbitrary phone numbers, which can be used to harass users or exhaust the SMS quota allocated by the operator’s Tencent Cloud service. The impact is therefore a denial of service and possible financial damage.

Affected software is the Jivejdon application from the commit set e0306088 through ee67a65e. The vendor is banq. No specific version numbers are supplied, but any deployment using these commits is vulnerable.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The endpoint is unauthenticated, so an attacker only needs to send HTTP requests, making exploitation straightforward. The lack of rate limiting makes the attack viable from the Internet without additional prerequisites.