CVE-2026-97064: X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of X-SpringBoot through version 6.0 are exposed if the default database seed remains in use. An attacker also needs to know a target account's email address or mobile number.
What does an attacker need to exploit it?
No authentication or user interaction is required. The attacker submits the static master code 172839 to the emailOrMobileLogin endpoint together with a known email address or mobile number, allowing authentication as that user.
Are default installations affected?
Yes. The hardcoded master login verification code is enabled by default in the database seed.
How can I determine whether my instance is affected?
Check whether your X-SpringBoot deployment is version 6.0 or earlier and whether its database contains the default enabled master verification code 172839. Also review the emailOrMobileLogin authentication path for acceptance of that code.