VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 13, 2026· Updated Mar 13, 2026

JumpServer Improper Certificate Validation in Custom SMS API Client

CVE-2026-31798

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Jumpserver/Jumpserverllm-fuzzy2 versions
    <4.10.16-lts+ 1 more
    • (no CPE)range: <4.10.16-lts
    • (no CPE)range: < 4.10.16-lts

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.