CVE-2026-31798 — JumpServer Improper Certificate Validation in Custom SMS API Client
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Cust…
Published: 2026-03-13 · CVSS: 5.0 · CVSS 3.1
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7