← Back

CVE-2026-31798

nvd nist
Published: Mar 13, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.0
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Exploitability: 1.6 / Impact: 3.4
Source: security-advisories@github.com (Secondary)

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.

Affected (1)

Fit2cloud
1 product
Jumpserver
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Jumpserver
Before 4.10.16

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.