HotGo vulnerabilities

CVEs whose affected-version data names the HotGo package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120447High· 8.1PoC

6d ago

HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile…

▾ Midnightbufanyun · HotGoEPSS 0.53%via CVEORG