HotGo lets attackers set SMS login codes and take over accounts

Summary

An unauthenticated attacker can choose the SMS login code in HotGo, then sign in as any user whose phone number they know, including administrators. Versions from 2.8.4 through 2.15.1 are affected.

Affected when

• An SMS provider configured on the instance
• Attacker knows the administrator's mobile number

What to do

Check that you run a version newer than 2.15.1 and read the vendor's advisory. No fixed version number is named in the sources.

Products and platforms

• HotGo

CVE IDs

• CVE-2026-120447 (opens in a new tab)

Sources

• Write-up: vul.yulun.ac.cn (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC