PT-2026-20544 · Googtech · Sms-Ssm

Jszdk · Published 2026-02-18 · Updated 2026-02-19 · CVE-2026-2676

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GoogTech sms-ssm versions prior to e8534c766fd13f5f94c01dab475d75f286918a8d

Description A weakness exists due to improper authorization. This issue is related to the preHandle function within the LoginInterceptor.java file of the API Interface component. The attack can be performed remotely. The exploit has been made publicly available.

Recommendations Update to a version prior to e8534c766fd13f5f94c01dab475d75f286918a8d.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-2676

Affected Products

Sms-Ssm

References · 10

• 🔥 https://github.com/GoogTech/sms-ssm/issues/27#issue-3878817166 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2676 · Security Note
• https://github.com/GoogTech/sms-ssm/issues/27#issuecomment-3828063958 · Note
• https://github.com/GoogTech/sms-ssm/issues/27 · Note
• https://vuldb.com/?submit.749702 · Note
• https://t.me/CVEtracker/45038 · Telegram Post
• https://vuldb.com/?id.346469 · Note
• https://vuldb.com/?ctiid.346469 · Note
• https://github.com/GoogTech/sms-ssm · Note
• https://twitter.com/CVEnew/status/2024258056272695651 · Twitter Post