Executive brief
Siam Ordering is a mobile-first ordering and commerce platform used by merchants and administrators. A hardcoded universal verification code ("123456") in the SMS login and password recovery functions allows attackers to bypass authentication and log in as any user—including administrators and merchants—using only a known phone number, resulting in complete account takeover and administrative privilege escalation.
Technical details
The vulnerability is an authentication bypass caused by a hardcoded master verification code ("123456") embedded directly in login and password recovery endpoints. When the mobileCode parameter equals "123456", the application skips SMS verification checks in AdminServiceImpl, MerchantServiceImpl, and MemberServiceImpl, proceeding directly to authentication. The vulnerable endpoints (/rest/admin/loginByMobile, /rest/admin/forgetPassword/step1) are excluded from the authentication interceptor and are publicly accessible without any token. An attacker only needs to enumerate or discover a target phone number to gain immediate access; no fix availability is documented in the advisory.
Affected products
- Siam Ordering siam-server 1.0.0
Timeline
- 2026-07-26: disclosed: Vulnerability disclosed on GitHub
- 2026-09-09: advisory: CVE-2026-71809 published