CVE-2026-97063: X-SpringBoot Auth Bypass Vulnerability

CVE-2026-97063 Overview

CVE-2026-97063 is an authentication bypass vulnerability [CWE-287] in X-SpringBoot through version 6.0. The application returns login verification codes directly in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code. The codes are never delivered to the account owner through SMS or email. Attackers who know a victim's mobile number or email address can request a code, read it from the response, and submit it to POST /sys/emailOrMobileLogin/login to authenticate as the victim. The flaw enables account takeover against any user whose contact identifier is known or guessable.

Critical Impact

Unauthenticated remote attackers can take over arbitrary user accounts, including administrative accounts, with no user interaction.

Affected Products

• X-SpringBoot through version 6.0
• Deployments exposing /sys/mobile/code endpoint
• Deployments exposing /sys/email/code endpoint

Discovery Timeline

• 2026-09-25 - CVE-2026-97063 published to the National Vulnerability Database (NVD)
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-97063

Vulnerability Analysis

X-SpringBoot implements a passwordless login flow in which users request a one-time code via SMS or email and submit it to authenticate. The controller logic in SysLoginController generates the verification code and returns it inside the HTTP response body of the code-request endpoints. The code is also stored server-side for subsequent validation but is never transmitted through an out-of-band channel to the account owner.

This design collapses the two-channel assumption that makes one-time codes effective. An attacker and the legitimate owner receive the same data over the same channel, and the attacker receives it first. Combined with the lack of authentication on the code-generation endpoints, any network-reachable actor can mint valid credentials for any registered account.

Root Cause

The root cause is improper authentication [CWE-287]. The verification code, which the login endpoint later treats as a shared secret, is disclosed in the response of an unauthenticated API call. The vulnerable controller code is published in the SysLoginController source.

Attack Vector

Exploitation requires only network access to the X-SpringBoot application and knowledge of a target user's mobile number or email address. An attacker issues GET /sys/mobile/code?mobile=<victim> or GET /sys/email/code?email=<victim>, parses the verification code from the JSON response, and submits it along with the victim identifier to POST /sys/emailOrMobileLogin/login. The server issues an authenticated session bound to the victim account. A proof of concept demonstrating the SMS variant is published in the VulnCheck advisory and the GitHub PoC repository.

See the referenced advisory and proof-of-concept for the specific request structure. Synthetic exploit code is omitted here.

Detection Methods for CVE-2026-97063

Indicators of Compromise

• Requests to /sys/mobile/code or /sys/email/code from unexpected source IPs or in high volume per identifier
• Successful POST /sys/emailOrMobileLogin/login events immediately preceded by a code request from the same client IP
• New authenticated sessions for privileged accounts originating from untrusted geographies or hosting providers
• Code-request traffic enumerating sequential mobile numbers or email prefixes

Detection Strategies

• Alert when a single client issues /sys/mobile/code or /sys/email/code requests for multiple distinct identifiers within a short window.
• Correlate code-request responses with subsequent login success events by source IP to flag same-session code harvest and login.
• Baseline normal verification-code request volumes per account and alert on deviations consistent with enumeration.

Monitoring Recommendations

• Capture full request and response bodies for the two code-issuing endpoints at the web application firewall or reverse proxy.
• Forward authentication telemetry to a centralized data lake for cross-source correlation of login anomalies.
• Monitor privileged account login events for impossible-travel and new-device conditions.

How to Mitigate CVE-2026-97063

Immediate Actions Required

• Block external access to /sys/mobile/code and /sys/email/code at the perimeter until a fix is deployed.
• Audit recent authentication logs for suspicious logins through /sys/emailOrMobileLogin/login.
• Force password or credential resets on any accounts showing anomalous activity.
• Rotate session tokens and invalidate active sessions issued since the application was exposed.

Patch Information

At the time of publication no vendor patch has been referenced in the available advisories. Monitor the upstream X-SpringBoot repository and the VulnCheck advisory for remediation guidance.

Workarounds

• Modify SysLoginController so verification codes are stored server-side only and are delivered exclusively through the SMS or email provider.
• Add rate limiting and CAPTCHA on code-generation endpoints to slow enumeration and abuse.
• Require an additional authentication factor, such as a password, in addition to the one-time code at the login endpoint.
• Restrict the code-issuing endpoints to authenticated or allowlisted contexts via a reverse proxy rule.

# Example NGINX rule to block external access to vulnerable endpoints
location ~ ^/sys/(mobile|email)/code$ {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}