Technical impact
The flaw resides in the SmsCodeServiceImpl.validateSmsCode0 method of ruoyi-vue-pro’s SMS Code Verification component, allowing a remote attacker to bypass the intended restriction on repeated authentication attempts. By manipulating the service, an attacker can repeatedly request or use SMS codes without restriction, potentially enabling exhaustive credential‑guessing or brute‑force attacks on user accounts and compromising confidentiality and integrity of the authentication process.
Affected Systems
The vulnerable product is ruoyi‑vue‑pro from YunaiV and zhijiantianya, affecting all releases up to and including 2026.09. No specific minor version is excluded, so any installation of the application prior to or equal to that date may be impacted.
Risk and Exploitability
The CVSS score of 6.3 places this vulnerability in the medium‑to‑high severity range. The EPSS score is unavailable, but the CVE notes that the exploit has been published and may be used, suggesting a high likelihood of exploitation. The attack can be carried out remotely with high complexity and deemed difficult to execute. As the vendor did not respond to the disclosure, the risk of continued exploitation increases. The vulnerability is not listed in CISA KEV, yet the lack of a vendor fix and the ability to profiteer from unlimited authentication attempts elevates the threat level.
