CVE-2026-97064

Received Received - Intake

X-SpringBoot Default Hardcoded Login Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97064

EUVD

EUVD-2026-87256

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1392	The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

Executive Summary

X-SpringBoot through version 6.0 includes a hardcoded static master login verification code 172839 in its default database seed. This allows unauthenticated attackers to bypass authentication by submitting this code to the emailOrMobileLogin endpoint along with a known email or mobile number, effectively impersonating any user.

Detection Guidance

Check if your X-SpringBoot application is using version 6.0 or earlier. Look for authentication attempts using the hardcoded master code 172839 via the emailOrMobileLogin endpoint. Monitor logs for repeated login attempts with this code.

Impact Analysis

An attacker could gain unauthorized access to user accounts, steal sensitive data, perform actions on behalf of legitimate users, or escalate privileges. This could lead to data breaches, financial loss, reputational damage, or compliance violations depending on the data exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face fines, legal penalties, and mandatory breach notifications if this flaw is exploited.

Mitigation Strategies

Upgrade X-SpringBoot to a version that removes the hardcoded master login code. If immediate upgrade is not possible, disable the emailOrMobileLogin endpoint or implement rate limiting and IP blocking for suspicious login attempts.

Hi! I’m here to help you understand CVE-2026-97064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70