HotGo CVE-2026-120447 Lets Attackers Bypass SMS Login for Admin Accounts

·11 views

A security advisory describes CVE-2026-120447, affecting HotGo versions 2.8.4 through 2.15.1. The flaw allows an unauthenticated attacker to supply their own verification code via the SMS send endpoint and then sign in through the mobile login path. Successful exploitation requires only a target mobile number and can lead to takeover of an administrator account. The advisory does not state that any internet-facing HotGo host has been compromised. Researchers used ZoomEye counts to estimate candidate deployments, but the matches must be confirmed as live, owned installations. Recommended mitigations include restricting admin and mobile login endpoints and disabling SMS login for privileged users until a fixed build is verified.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CVE-2026-58115: Unauthenticated Node-RED Admin API Enables Full Takeover of Siemens Industrial Gateway

A critical vulnerability, CVE-2026-58115 with a CVSS score of 10.0, affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED before version V4.3.4.1. Node-RED's editor and Admin API lack authentication by default, and on the affected product this setting was left off, letting a remote attacker deploy flows that execute arbitrary commands with maximum privileges. The flaw stems from a missing authorization boundary rather than a code bug, and the attack relies only on built-in inject and exec nodes, which makes it hard to distinguish from normal automation. Siemens disclosed the issue on August 11, 2026, and researchers at VulnCheck recorded a live exploitation attempt on October 30, 2026, three days after publishing a detection signature. Siemens recommends upgrading to Industrial OS V4.3.4.1 or later.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ByteStash API Keys Stayed Valid After Account Deactivation (CVE-2026-126658)

A flaw in ByteStash versions 1.5.10 through 1.6.2 lets API keys keep working after the owning account has been deactivated. The API-key validation path does not verify whether the account is still active, so administrators who disable a user may believe access has ended when it has not. Any holder of a surviving key, including a former user, a compromised client, or an automation, could keep reading or modifying stored snippets, which may contain sensitive internal material. The recommended remedy is upgrading to version 1.6.2 and confirming that deactivated keys are rejected, along with auditing and rotating keys and reviewing logs for post-deactivation use. Organizations unable to upgrade immediately should restrict API and MCP access as a temporary measure, since this does not fix the underlying account-status check.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Podcast Intro Generator with ElevenLabs Text-to-Speech

A DEV Community tutorial explains how to automate podcast intros using text-to-speech technology, since recording a new intro for every episode is time-consuming for solo creators. The proposed pipeline gathers the episode title and tagline, merges them into a script template, sends the text to the ElevenLabs API, and post-processes the audio with fades and loudness normalization. The author provides a Python wrapper that handles authentication, voice selection, and saving the returned audio as an MP3 file. The article also suggests cloning one's own voice in the ElevenLabs dashboard for consistent branding across episodes, and recommends using a templating tool such as Jinja2 to inject episode-specific details. The tutorial includes a referral link to ElevenLabs for obtaining an API key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What a SERP API Is and How Its Pricing Compares in 2026

A SERP API converts a search engine results page into structured JSON, returning fields such as position, title, URL, and snippet along with optional modules. The author notes it fetches live pages rather than crawling or indexing, so stored data cannot be re-fetched and parsers must adapt to layout changes. Responses include a status field, since an HTTP 200 can still carry a parse error, plus a request ID and the credits charged per call. Using price figures from a public comparison table checked in late October 2026, the article shows that at a $200 monthly budget, SerpBase, Serper, and SerpApi differ roughly 28-fold in how many searches they deliver. The author cautions that coverage varies between providers and that cheaper options may lack needed fields.

0 comments Read more at DEV Community