CVE-2026-107830

MEDIUM 5.3

Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.

CWE	CWE-799
Vendor	banq
Product	jivejdon
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for banq jivejdon

Be the first to know when new medium vulnerabilities affecting banq jivejdon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

banq / jivejdon

e03060885db5726e46d30f55ac67920318d0d1fc ≤ ee67a65e65228644a71c8317d7e34deea50f95ef

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/banq/jivejdon/issues/28 github.com: https://github.com/banq/jivejdon github.com: https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79 github.com: https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29 vulncheck.com: https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint

Credits

Ikram-4