CVE-2026-97063— X-SpringBoot through 6.0 Authentication Bypass via Login Code
Quick assessment
Affected
yzcheng90 X-SpringBoot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
X-SpringBoot 通过 6.0 版本存在安全漏洞。该漏洞表现为：在通过 GET /sys/mobile/code 和 GET /sys/email/code 等未经验证的端点请求时，系统会在 HTTP 响应中返回登录验证码，而不会将这些验证码发送给对应的账户持有人。攻击者可以利用已知的手机号码或电子邮件地址请求验证码，从响应中读取验证码，并通过 POST /sys/emailOrMobileLogin/login 接口以受害者身份进行认证，从而实现账户劫持。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97063
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
X-SpringBoot through 6.0 Authentication Bypass via Login Code
Source: CVE Program / CVE List V5
Vulnerability Description
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yzcheng90 | X-SpringBoot | 0 ~ 6.0 | - |
|
II. Public POCs for CVE-2026-97063
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97063
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-97063 (1)
Proof of Concept for CVE-2026-97063 (1)
Other References for CVE-2026-97063 (1)
Same Patch Batch · yzcheng90 · 2026-09-25 · 4 CVEs total
| CVE-2026-97064 | 9.1 CRITICAL | X-SpringBoot through 6.0 Authentication Bypass via Static Master Code |
| CVE-2026-97060 | 7.2 HIGH | X-SpringBoot through 6.0 Authorization Bypass via User Management |
| CVE-2026-100192 | 6.5 MEDIUM | X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint |
IV. Related Vulnerabilities
Same product: X-SpringBoot
-
CVE-2026-97064
X-SpringBoot through 6.0 Authentication Bypass via Static Ma -
CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthentic -
CVE-2026-97060
X-SpringBoot through 6.0 Authorization Bypass via User Manag -
CVE-2025-6731
yzcheng90 X-SpringBoot APK File apk uploadApk path traversal
Same vendor: yzcheng90
-
CVE-2026-97064
X-SpringBoot through 6.0 Authentication Bypass via Static Ma -
CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthentic -
CVE-2026-97060
X-SpringBoot through 6.0 Authorization Bypass via User Manag -
CVE-2025-6731
yzcheng90 X-SpringBoot APK File apk uploadApk path traversal
Same weakness: CWE-287
-
CVE-2026-101073
Netcore NR289-GE CGI Dispatcher boa improper authentication -
CVE-2026-52749
Improper Authentication in Kaon AR2140X -
CVE-2026-100886
Seetong T8108/T8108P/T8116/T8232 Debug Service improper auth -
CVE-2026-101050
Heym before 0.0.53 Authentication Bypass via Telegram Webhoo -
CVE-2026-101049
Heym before 0.0.53 Slack Webhook Signature Verification Bypa
V. Comments for CVE-2026-97063
No comments yet