CVE-2026-100192: X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the application's GET /application/manager/select endpoint can retrieve exposed appKey and appSecret credentials. No prior account or user interaction is required.
What could an attacker do with the exposed credentials?
The credentials can be used to send arbitrary SMS messages through any tenant's configured SMS provider. This enables SMS bombing and messages that impersonate the affected tenant.
Which deployments are affected?
X-SpringBoot through version 6.0 is affected where the vulnerable endpoint is reachable. The issue is present because the endpoint lacks authentication and field filtering.
How can I check whether an instance is exposed?
Verify whether GET /application/manager/select is reachable without authentication and whether its response includes appKey or appSecret values. Exposure of either credential field indicates the endpoint is disclosing SMS-provider credentials.