CVE-2026-97064
CriticalCVSS 9.1Summary
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
Risk Assessment
An attacker can take over any account, including administrative ones, without knowing the password. Critical risk to the security of the entire system.
Recommendation
Update X-SpringBoot to a version without the hardcoded master code or remove/change the default 172839 code in the database. Implement additional login verification mechanisms.
Other vulnerabilities in X-SpringBoot
See all- CVE-2026-97060High
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.
- CVE-2026-97063Critical
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Original NVD description (English source)
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS