CVE-2026-97063 - X-SpringBoot through 6.0 Authentication Bypass via Login Code

Back Back to CVE browser

CRITICAL

X-SpringBoot through 6.0 Authentication Bypass via Login Code

Published Sep 25, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.29%

Description

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.

Affected products

Vendor Yzcheng90 Product X-SpringBoot Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yzcheng90

X-SpringBoot

unaffected

Version	Status	Constraints
0	affected	<=6.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87255		Advisory
https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.py		exploit
https://github.com/yzcheng90/X-SpringBoot		product
https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L134		technical-description
https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-login-code		third-party-advisory