CVE-2026-97063

CriticalCVSS 9.1/10Last modified Sep 28, 2026

Description

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 25, 2026
Last modified: Sep 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-970649.1X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauth CVE-2026-970657.1Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.CVE-2026-970665.3Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-970676.5Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-970706.9Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configure CVE-2026-970715.3Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through CVE-2026-970744.3Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.CVE-2026-970756.5Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-970767.5Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n CVE-2026-970777.1Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.CVE-2026-970785.3Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.CVE-2026-970794.3Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.