Verified

CVE-2026-94256: SMS Alert 4.0.0 to before 4.0.1

Affected technology

SMS Alert · 4.0.0 to before 4.0.1
Vendor not specified by the source

Description’s affected range: before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

Published 2026-10-10 06:17:39.471655+00:00

KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-10 07:23:45.480922+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-10 06:17:36.054866+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-94256.html