CVE-2026-116007

The record

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-307
• CVE-2026-111501 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of… CWE-307
• CVE-2026-22114 HTTP basic auth enforces no retry limit or backoff. CWE-307
• CVE-2026-107256 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield… CWE-307
• CVE-2026-15586 Improper restriction of excessive authentication attempts vulnerability in İdvlabs… CWE-307
• CVE-2026-107145 The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the… CWE-307
• CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-307
• CVE-2026-61611 Lychee is a free, open-source photo-management tool. CWE-307