CVE-2026-107830 MEDIUM

CVE-2026-107830: Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Vendor Banq
Product jivejdon
Weakness CWE-799
Published October 8, 2026
Last update October 8, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.

Key dates

02Disclosure timeline

October 8, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2023-40673 WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerability CVE-2024-13274 Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 CVE-2023-51544 WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerability CVE-2023-40332 WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability CVE-2024-24873 WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerability