X-SpringBoot through version 6.0 ships with a hardcoded master login verification code, so unauthenticated attackers can log in as any user whose email address or mobile number they know.
What Is It
CVE-2026-97064 is an authentication bypass in X-SpringBoot, an open-source project by yzcheng90. The database seed that ships with the project contains a static master login verification code, 172839, and enables it by default. An attacker who sends this public code to the emailOrMobileLogin endpoint with a known email address or mobile number is authenticated as that user.
The weakness is classified as CWE-1392 (Use of Default Credentials). The published references point to the seed data in doc/x_springboot.sql and to the login logic in SysLoginController.java.
Why It Matters
VulnCheck, the CNA, scores this issue at CVSS 3.1 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Its CVSS 4.0 score is 9.3 (Critical). The attack works over the network, has low complexity, and needs no privileges or user interaction. The impact on confidentiality and integrity is high.
The master code is fixed and publicly disclosed, and it is enabled by default. That makes this a straightforward account takeover against any deployment that kept the seeded configuration. The NVD references include a public proof-of-concept script that demonstrates account takeover.
At the time of writing, CVE-2026-97064 does not appear in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: yzcheng90
- Product: X-SpringBoot
- Affected versions: 0 through 6.0 (inclusive)
- Package:
pkg:github/yzcheng90/X-SpringBoot
Deployments built from the default database seed are affected, because the master verification code is enabled by default.
Patch Status
The supplied NVD and advisory data do not list a fixed version or vendor patch. NVD lists the record as "Received" (published 2026-09-25) and has not analyzed it yet. CISA has not issued a required action because the CVE is not in KEV.
Operators running X-SpringBoot 6.0 or earlier should check the vendor repository and the VulnCheck advisory for remediation updates. They should also review whether the seeded master verification code is present and enabled in their deployments.