CVE-2026-97063

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0

Description Unauthenticated endpoints return login verification codes directly in HTTP responses without sending them to the account owners. An attacker can request these codes using a known mobile number or email address via the endpoints 'GET /sys/mobile/code' and 'GET /sys/email/code'. By reading the codes from the responses, the attacker can then authenticate as the victim through the 'POST /sys/emailOrMobileLogin/login' endpoint to hijack accounts.

Recommendations Update X-SpringBoot to a version later than 6.0. Restrict access to the 'GET /sys/mobile/code' and 'GET /sys/email/code' endpoints to prevent unauthorized code requests.