CVE-2026-97063 — X-SpringBoot through 6.0 Authentication Bypass via Login Code
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to a…
Published: 2026-09-25 · CVSS: 9.3 · CVSS 4.0
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7