CVE-2026-97063 in X-SpringBoot
Summary
by MITRE • 09/25/2026
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in X-SpringBoot versions through 6.0 represents a critical failure in authentication logic that allows for complete account takeover without valid credentials. This flaw is rooted in the improper handling of multi-factor authentication (MFA) verification codes, specifically within the endpoints responsible for generating and delivering one-time passwords to users via SMS or email. The core technical issue lies in the server's decision to return the generated verification code directly within the HTTP response body when accessed by unauthenticated clients. This design choice fundamentally violates the principle of secure communication channels required for sensitive authentication data, as it exposes secrets that should only be transmitted through out-of-band methods such as actual mobile networks or email servers.
The attack vector exploits this misconfiguration by targeting two specific GET endpoints: /sys/mobile/code and /sys/email/code. An attacker does not need to possess valid login credentials or bypass any initial authentication gate to access these resources. Instead, the vulnerability allows for a straightforward enumeration of user accounts if mobile numbers or email addresses are known or guessed. By sending HTTP requests to these endpoints with specific target identifiers, an adversary can retrieve the corresponding verification codes directly from the server's response payload. This capability effectively neutralizes the security benefit provided by two-factor authentication, as the second factor is no longer secret and remains under the control of any party that can interact with the API.
Once the attacker has obtained a valid verification code for a target account, they proceed to exploit the login mechanism at POST /sys/emailOrMobileLogin/login. By submitting the stolen code along with the associated mobile number or email address, the system incorrectly validates the session and grants access to the victim's account. This sequence of actions facilitates unauthorized access, leading to potential data breaches, identity theft, and financial loss depending on the nature of the application and stored user information. The impact is severe because it allows for remote code execution in terms of administrative control over user accounts without requiring any prior compromise of passwords or other secrets held by the victim.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-613, Insufficient Session Expiration, if the codes remain valid for extended periods. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically within the context of Initial Access where attackers leverage legitimate credentials or authentication mechanisms inappropriately gained. The root cause is a design flaw rather than a simple coding error, indicating that the security architecture failed to enforce separation between information disclosure and functional logic during the development phase.
Mitigation strategies must focus on eliminating the direct exposure of verification codes through API responses. Developers should ensure that these endpoints do not return the actual code in HTTP payloads under any circumstances. Instead, systems should rely exclusively on external delivery mechanisms such as SMS gateways or email servers to transmit one-time passwords to end-users. Additionally implementing rate limiting and CAPTCHA challenges on these endpoints can help prevent automated enumeration attacks where attackers attempt to brute-force valid phone numbers or emails. It is also advisable to enforce strict input validation and ensure that session tokens are generated securely only after successful multi-factor authentication has been completed through secure channels. Regular security audits and penetration testing should be conducted to verify that no other endpoints inadvertently leak sensitive authentication data in response bodies.