Technical impact
The vulnerability resides in the AuthController.java file of the SMS Code Verification component for yunaiV and zhijiantianya uyruoyi‑vue‑pro. By manipulating the mobile and code parameters, an attacker can bypass authentication checks, granting unauthorized access to the system. This flaw is classified as CWE‑287, representing an authentication bypass weakness that compromises the integrity of the user identity validation process.
Affected Systems
The affected products are YunaiV and zhijiantianya’s ruoyi‑vue‑pro application, with all releases up to 2026.09 vulnerable; no specific build or patch information is available beyond the cutoff date. Users running any of these versions should verify if they match the affected release window.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, although the flaw is publicly documented and can be triggered remotely. The vulnerability is not yet listed in the CISA KEV catalog, but its exploitation potential is real and the attack can be performed over the network targeting the exposed endpoint. The overall risk remains significant for systems that rely on SMS code verification for login and therefore should be addressed promptly.
