ruoyi-vue-pro - Authentication Bypass (CVE-2026-116006)

CVE-2026-116006 is an authentication bypass vulnerability in ruoyi-vue-pro’s SMS code verification component, caused by improper handling of the mobile and code arguments in AuthController.java. Remote unauthenticated attackers may exploit the publicly disclosed flaw to bypass verification and gain unauthorized access, potentially affecting the confidentiality, integrity, and availability of the application.

CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-116006 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2026-116006 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target /admin-api/system/auth/send-sms-code and /admin-api/system/auth/sms-login to abuse the SMS authentication flow. The exploit uses the predictable verification code 9999 with a target mobile number to attempt to obtain an access token without authentication.