CVE-2026-97063

Received Received - Intake

X-SpringBoot Login Code Exposure via Unauthenticated Endpoints

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97063

EUVD

EUVD-2026-87255

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

X-SpringBoot through version 6.0 has a flaw where login verification codes are exposed in HTTP responses from unauthenticated endpoints. Attackers can request codes for known mobile numbers or email addresses and then use those codes to log in as victims via a different endpoint, effectively hijacking accounts.

Detection Guidance

Check for unauthenticated access to endpoints GET /sys/mobile/code and GET /sys/email/code. Monitor HTTP responses for login verification codes being returned without proper authentication. Use network traffic analysis tools to inspect requests and responses to these endpoints.

Impact Analysis

If you use X-SpringBoot 6.0 or earlier, attackers could hijack your accounts by intercepting verification codes sent to your email or phone. This could lead to unauthorized access to sensitive data, financial loss, or identity theft.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through insecure transmission of verification codes. For HIPAA, it may compromise protected health information if accounts are hijacked. Organizations must address this to maintain compliance.

Mitigation Strategies

Disable or restrict access to the vulnerable endpoints GET /sys/mobile/code and GET /sys/email/code. Implement proper authentication and authorization checks for these endpoints. Ensure login verification codes are only returned after successful user verification.

Hi! I’m here to help you understand CVE-2026-97063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70