CVE-2026-100192

Received Received - Intake

X-SpringBoot Credential Exposure Leading to SMS Abuse

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100192

EUVD

EUVD-2026-87253

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

X-SpringBoot through version 6.0 has a vulnerability where sensitive credentials appKey and appSecret are exposed in the GET /application/manager/select endpoint without requiring authentication or proper field filtering. This allows unauthenticated attackers to retrieve these credentials and misuse them.

Detection Guidance

To detect this vulnerability, check if the endpoint GET /application/manager/select is accessible without authentication. Use tools like curl to send a GET request to the endpoint and inspect the response for appKey and appSecret credentials. Example command: curl -v http://<target-ip>/application/manager/select

Impact Analysis

Unauthenticated attackers can use the exposed credentials to send arbitrary SMS messages through any tenant's SMS provider. This enables SMS bombing attacks and allows attackers to impersonate legitimate users or systems.

Compliance Impact

The vulnerability exposes appKey and appSecret credentials without authentication, enabling unauthorized access to SMS messaging systems. This could lead to data breaches, unauthorized communications, and impersonation attacks, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if SMS messages contain sensitive data.

Mitigation Strategies

Immediately restrict access to the /application/manager/select endpoint by implementing authentication. Update X-SpringBoot to the latest version that patches this issue. Monitor network traffic for unauthorized access attempts to this endpoint.

Hi! I’m here to help you understand CVE-2026-100192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70