Is CVE-2026-107830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107830 being exploited in the wild.

How severe is CVE-2026-107830?

Medium severity, with a CVSS score of 5.3, published 8 October 2026.

Which products and versions are affected?

Banq Jivejdon from commit e0306088 through commit ee67a65e.

Is there a fix for CVE-2026-107830?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107830 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107830?

Check whether you run Banq Jivejdon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107830: Jivejdon SMS rate limiting bypass in unauthenticated endpoint

CVE-2026-107830 · Severity: medium · CVSS 5.3 · Published 2026-10-08

Jivejdon is a web-based notebook and collaboration platform that integrates SMS verification for user account creation. This vulnerability allows attackers to send unlimited SMS messages through an unauthenticated endpoint without rate limiting, enabling them to harass phone numbers and drain the application operator's Tencent Cloud SMS budget. An attacker can load the account creation page to set session variables, then repeatedly trigger SMS sends to arbitrary numbers.

Technologies: Banq Jivejdon. Vendors: Banq.

Quick answers

Is CVE-2026-107830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107830 being exploited in the wild.
How severe is CVE-2026-107830?: Medium severity, with a CVSS score of 5.3, published 8 October 2026.
Which products and versions are affected?: Banq Jivejdon from commit e0306088 through commit ee67a65e.
Is there a fix for CVE-2026-107830?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107830 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107830?: Check whether you run Banq Jivejdon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /account/smsVRAction endpoint handled by SmsQQAction lacks rate limiting and is accessible without authentication. Attackers can exploit session manipulation via the newAccount.jsp page to set required attributes, then make rapid requests to the SMS endpoint to send unlimited messages. This allows cost exhaustion and harassment attacks against arbitrary phone numbers.

Affected products

banq Jivejdon from commit e0306088 through commit ee67a65e

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.