CVE-2026-97063
Last modified
CVE-2026-97063 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts..
Description
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| yzcheng90 | X-SpringBoot | <= 6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-97063?
How severe is CVE-2026-97063?
How do I fix CVE-2026-97063?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-97057redis-parser through 3.0.0 fails to validate the multi-bulk …7.5
- CVE-2026-97058Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-97059DCMTK through 3.7.0 contains a heap over-read vulnerability …8.2
- CVE-2026-97060X-SpringBoot through 6.0 lacks object-level authorization in…7.2
- CVE-2026-97061Black Candy through 3.2.1 fails to scope playlist search que…4.3
- CVE-2026-97062Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores up…5.4
- CVE-2026-97064X-SpringBoot through 6.0 ships with a hardcoded static maste…9.1
- CVE-2026-97065Unauthenticated Cross Site Scripting (XSS) in Happyforms <= …7.1
- CVE-2026-97066Unauthenticated Insecure Direct Object References (IDOR) in …5.3
- CVE-2026-97067Contributor Cross Site Scripting (XSS) in EWWW Image Optimiz…6.5
- CVE-2026-97070Authorization Bypass Through User-Controlled Key vulnerabili…6.9
- CVE-2026-97071Incorrect Calculation vulnerability in VillaTheme CURCY woo-…5.3
Are you affected by CVE-2026-97063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST