Critical Authentication Bypass Vulnerability in HotGo: CVE-2026-120447
A critical authentication bypass vulnerability (CVE-2026-120447) has been discovered in HotGo versions 2.8.4 through 2.15.1. This vulnerability allows unauthenticated attackers to bypass authentication by supplying a chosen SMS verification code, potentially leading to account takeover, including administrator accounts. The vulnerability has a CVSS score of 8.1 and is considered high severity. Organizations using affected versions of HotGo should immediately apply patches or mitigations to prevent exploitation.