Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-97063: X‑SpringBoot 6.0 lets attackers log in without password
CVE-2026-97063 · published 2 days ago
Summary
The X‑SpringBoot framework (up to version 6.0) returns login codes to anyone who asks for them, even if they are not the account owner. An attacker can request a code for a known phone number or email, read the code from the web response, and then use it to sign in as that user. Update to a patched version of X‑SpringBoot or apply a fix that stops the code‑returning endpoints from being accessible without authentication.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| yzcheng90 | x-springboot | <= 6.0 |
Original advisory text
X-SpringBoot through 6.0 Authentication Bypass via Login Code
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-co... exploit
- https://github.com/yzcheng90/X-SpringBoot product
- https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7... technical-description
- https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-byp... third-party-advisory
Severity
9.3
Critical
CVSS 3.1: 9.1 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-287Improper Authentication
Timeline
Published25 Sep 2026
Updated27 Sep 2026
First seen25 Sep 2026
Track software like this
Free during beta