---
id: CVE-2026-107830
title: >-
  Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on
  the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction,
  allowing unlimited SMS sending
summary: >-
  Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on
  the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction,
  allowing unlimited SMS sending. Attackers can load newAccount.jsp to set
  session attri…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-799
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:18.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107830'
references:
  - url: 'https://github.com/banq/jivejdon'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79
    label: disclosure@vulncheck.com
  - url: 'https://github.com/banq/jivejdon/issues/28'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00384
epssPercentile: 0.32256
ingestedAt: '2026-10-08T23:16:47.393Z'
vendor: banq
product: jivejdon
affected:
  - >-
    jivejdon >= e03060885db5726e46d30f55ac67920318d0d1fc <=
    ee67a65e65228644a71c8317d7e34deea50f95ef
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-13T16:10:45.952293Z'
---

## Overview

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.