CVE-2026-97063: X-SpringBoot through 6.0 Authentication Bypass via Login Code
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Affected Software
Event History
Frequently Asked Questions
What information does an attacker need to take over an account?
An attacker needs a known victim mobile number or email address. They can request a login code from an unauthenticated endpoint, read the code in the HTTP response, and submit it to the login endpoint as the victim.
Are unauthenticated deployments exposed?
Yes. The affected code-request endpoints, GET /sys/mobile/code and GET /sys/email/code, are unauthenticated, so no existing account or privileges are required to obtain the returned verification codes.
How can I determine whether an instance is affected?
Test whether requests to GET /sys/mobile/code or GET /sys/email/code return a usable login verification code in the HTTP response instead of only delivering it to the account owner. If that code permits authentication through POST /sys/emailOrMobileLogin/login, the instance is affected.