In X-SpringBoot through version 6.0, unauthenticated endpoints send login verification codes back in the HTTP response instead of to the account owner, so an attacker can take over accounts without any credentials.
What Is It
CVE-2026-97063 is an authentication flaw (CWE-287) in X-SpringBoot, an open-source project maintained by yzcheng90. The unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code generate login verification codes. They return those codes directly in the HTTP response and never deliver them to the account owner.
An attacker who knows a victim's mobile number or email address can request a code and read it from the response. They can then submit it to POST /sys/emailOrMobileLogin/login to sign in as the victim.
VulnCheck published the CVE on 2026-09-25. Its NVD status is "Received."
Why It Matters
VulnCheck scores this CVSS 3.1 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Under CVSS 4.0 it scores 9.3 (Critical). It can be exploited over the network with low complexity, no privileges and no user interaction. The impact on confidentiality and integrity is high.
CISA's SSVC assessment rates exploitation as "poc", automatable as "yes" and technical impact as "total". A public proof-of-concept script is referenced in the NVD record.
The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No KEV entry was supplied, so active exploitation in the wild is not confirmed. However, a public PoC exists, exploitation is automatable, and the attacker only needs a phone number or email address, which lowers the barrier to exploitation.
What's Vulnerable
- Vendor: yzcheng90
- Product: X-SpringBoot
- Affected versions: all versions through 6.0 (version 0 to ≤ 6.0)
- Package:
pkg:github/yzcheng90/X-SpringBoot
The affected logic is in SysLoginController.java (lines 94–134 at the referenced commit). The NVD record lists no CPEs.
Patch Status
The supplied NVD and KEV data list no fixed version or vendor patch. There is no CISA KEV required action because the CVE is not in the catalog.
Operators running X-SpringBoot 6.0 or earlier should check the project repository and the VulnCheck advisory for fix updates. Until a fix is confirmed, treat any exposed deployment that uses email or mobile code login as vulnerable to account takeover.