HotGo versions through 2.15.1 allow unauthenticated attackers to specify a custom SMS verification code by supplying a Code parameter to the /admin/sms/send API. Because the code is not validated against a stored value, an attacker who knows a target user’s mobile number can force the system to accept any code they provide. After setting a known code, the attacker can use the /admin/site/mobileLogin endpoint to authenticate as that user, which can compromise ordinary user or administrator accounts. The weakness is a classic authentication bypass flaw.

The affected product is HotGo from bufanyun. The vulnerability exists in all releases up to and including version 2.15.1. Earlier versions of HotGo that implement the same /admin/sms/send endpoint are also impacted. No specific sub‑version list is provided, so any installation of HotGo 2.15.1 or older is potentially vulnerable.

The CVSS score of 9.2 categorizes this flaw as critical. No EPSS score is supplied, so the relative exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the affected API and knowledge of a target’s mobile number. An attacker can remotely trigger the vulnerable endpoint, override the verification code, and log in as the target, thereby achieving full account compromise, including administrative control.