The vulnerability exists because the Custom SMS API Client in JumpServer does not properly validate TLS certificates when sending multi-factor authentication (MFA) or one-time password (OTP) codes. As a result, an attacker can intercept the outbound request and capture the verification code before it reaches the intended user, enabling unauthorized access to protected accounts. This weakness is a certificate validation failure (CWE‑295).

Affected systems include the JumpServer open source bastion host with any version prior to 4.10.16-lts. The product is identified as jumpserver:jumpserver. No specific revision list is provided beyond the stated fix version; all earlier releases are vulnerable.

The CVSS score of 5 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to intercept or manipulate network traffic targeting the Custom SMS API endpoint, so the attack vector is likely network-based and may be limited to environments without strict TLS enforcement. Given the moderate score and low EPSS, the risk is considered moderate but not negligible.