diff --git a/fys-admin/src/main/java/com/fuyuanshen/app/controller/AppUserController.java b/fys-admin/src/main/java/com/fuyuanshen/app/controller/AppUserController.java
index c23a789..fd6c4e4 100644
--- a/fys-admin/src/main/java/com/fuyuanshen/app/controller/AppUserController.java
+++ b/fys-admin/src/main/java/com/fuyuanshen/app/controller/AppUserController.java
@@ -1,17 +1,29 @@
 package com.fuyuanshen.app.controller;
 
 import cn.dev33.satoken.annotation.SaIgnore;
+import cn.hutool.core.util.RandomUtil;
 import com.fuyuanshen.app.domain.dto.APPForgotPasswordDTO;
 import com.fuyuanshen.app.domain.dto.APPForgotPasswordSmsDTO;
 import com.fuyuanshen.app.domain.dto.APPUpdateUserDTO;
 import com.fuyuanshen.app.domain.vo.APPUserInfoVo;
 import com.fuyuanshen.app.service.IAppUserService;
+import com.fuyuanshen.common.core.constant.Constants;
+import com.fuyuanshen.common.core.constant.GlobalConstants;
 import com.fuyuanshen.common.core.domain.R;
+import com.fuyuanshen.common.ratelimiter.annotation.RateLimiter;
+import com.fuyuanshen.common.redis.utils.RedisUtils;
 import com.fuyuanshen.common.web.core.BaseController;
+import jakarta.validation.constraints.NotBlank;
 import lombok.RequiredArgsConstructor;
+import org.dromara.sms4j.api.SmsBlend;
+import org.dromara.sms4j.api.entity.SmsResponse;
+import org.dromara.sms4j.core.factory.SmsFactory;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
+import java.time.Duration;
+import java.util.LinkedHashMap;
+
 /**
  * APP 用户管理
  * @date 2025-06-27
@@ -50,13 +62,27 @@ public class AppUserController extends BaseController {
     }
 
 
-
     /**
      * 发送忘记密码短信
+     *
+     * @param phonenumber 用户手机号
      */
     @SaIgnore
-    @PostMapping("/sendForgotPasswordSms")
-    public R<Void> sendForgotPasswordSms(@Validated @RequestBody APPForgotPasswordSmsDTO dto) throws Exception {
-        return toAjax(appUserService.sendForgotPasswordSms(dto));
+    @RateLimiter(key = "#phonenumber", time = 60, count = 1)
+    @GetMapping("/sendForgotPasswordSms")
+    public R<Void> smsCode(@NotBlank(message = "{user.phonenumber.not.blank}") String phonenumber) {
+        String key = GlobalConstants.APP_FORGOT_PASSWORD_SMS_KEY + phonenumber;
+        String code = RandomUtil.randomNumbers(4);
+        RedisUtils.setCacheObject(key, code, Duration.ofMinutes(Constants.CAPTCHA_EXPIRATION));
+        // 验证码模板id 自行处理 (查数据库或写死均可)
+        String templateId = "";
+        LinkedHashMap<String, String> map = new LinkedHashMap<>(1);
+        map.put("code", code);
+        SmsBlend smsBlend = SmsFactory.getSmsBlend("config1");
+        SmsResponse smsResponse = smsBlend.sendMessage(phonenumber, map);
+        if (!smsResponse.isSuccess()) {
+            return R.fail(smsResponse.getData().toString());
+        }
+        return R.ok();
     }
 }
diff --git a/fys-admin/src/main/java/com/fuyuanshen/web/controller/CaptchaController.java b/fys-admin/src/main/java/com/fuyuanshen/web/controller/CaptchaController.java
index bb066b9..d243139 100644
--- a/fys-admin/src/main/java/com/fuyuanshen/web/controller/CaptchaController.java
+++ b/fys-admin/src/main/java/com/fuyuanshen/web/controller/CaptchaController.java
@@ -67,7 +67,7 @@ public class CaptchaController {
         LinkedHashMap<String, String> map = new LinkedHashMap<>(1);
         map.put("code", code);
         SmsBlend smsBlend = SmsFactory.getSmsBlend("config1");
-        SmsResponse smsResponse = smsBlend.sendMessage(phonenumber, templateId, map);
+        SmsResponse smsResponse = smsBlend.sendMessage(phonenumber, map);
         if (!smsResponse.isSuccess()) {
             log.error("验证码短信发送异常 => {}", smsResponse);
             return R.fail(smsResponse.getData().toString());