CVE-2026-100192
MediumCVSS 6.5Summary
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Risk Assessment
Exposure of SMS credentials can lead to abuse such as mass messaging (SMS bombing) and impersonation of the organization, resulting in financial and reputational damage. It may also breach customer trust and regulatory compliance.
Recommendation
Update X-SpringBoot to a version later than 6.0 if available, or immediately secure the endpoint by enforcing authentication and filtering sensitive fields. Consider rotating exposed credentials and monitoring for unauthorized SMS usage.
Other vulnerabilities in X-SpringBoot
See all- CVE-2026-97060High
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
- CVE-2026-97064Critical
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
- CVE-2026-97063Critical
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Original NVD description (English source)
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS