CVE-2026-120447

The software HotGo through 2.15.1 is susceptible to an authentication bypass vulnerability. An unauthenticated attacker who knows a user's mobile number can supply a custom value to the Code field at the /admin/sms/send endpoint. By pre-setting a known verification code, the attacker can then sig...