X-SpringBoot (<= 6.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/x-springboot--6.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 25 Sep 2026 20:55:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure and Account Hijacking in X-SpringBoothttps://feed.craftedsignal.io/briefs/2026-09-x-springboot-auth-bypass/Fri, 25 Sep 2026 20:55:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-x-springboot-auth-bypass/The X-SpringBoot application up to version 6.0 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve login verification codes and hijack user accounts.X-SpringBoot versions 6.0 and earlier contain a critical vulnerability where sensitive login verification codes are returned directly in the HTTP response body for unauthenticated API endpoints. Specifically, the endpoints '/sys/mobile/code' and '/sys/email/code' leak these codes without requiring authentication and without sending the codes to the intended account owners. An attacker can supply a target's mobile number or email address as a parameter to these endpoints and receive the valid verification code in the server response. With this code, the attacker can then authenticate as the victim via the '/sys/emailOrMobileLogin/login' endpoint. This flaw enables widespread account hijacking by bypassing standard MFA or verification workflows. Defenders should identify instances of X-SpringBoot 6.0 or lower and restrict access to these endpoints or upgrade to a patched version once available.

Attack Chain

  1. Attacker identifies a target mobile number or email address.
  2. Attacker sends an unauthenticated HTTP GET request to /sys/mobile/code or /sys/email/code.
  3. The vulnerable application processes the request and generates a verification code.
  4. The application improperly embeds the code in the JSON response body sent to the client.
  5. The attacker parses the HTTP response to extract the verification code.
  6. The attacker submits the stolen code along with the target's identifier to /sys/emailOrMobileLogin/login.
  7. The application validates the code, granting the attacker a session as the target user.
  8. Attacker gains full unauthorized access to the victim's account.

Impact

Successful exploitation allows unauthenticated attackers to hijack any account within an exposed X-SpringBoot instance. This could lead to full account takeover, unauthorized access to sensitive user data, and potential lateral movement if the hijacked accounts possess elevated privileges. Given the CVSS score of 9.1, the impact is severe, particularly for internet-facing installations.

Recommendation

  1. Identify and inventory all internet-facing instances of X-SpringBoot running version 6.0 or lower.
  2. Implement strict network-level access control to block external access to the /sys/mobile/code and /sys/email/code endpoints until a patch is applied.
  3. Deploy web application firewall (WAF) rules to inspect and alert on suspicious patterns of repeated requests to verification endpoints originating from single source IPs.
  4. Monitor application logs for high volumes of 200 OK responses to /sys/mobile/code or /sys/email/code that are not followed by successful logins from the target user's known devices.
]]>criticaladvisoryweb-applicationauthentication-bypasscvewebservervulnerabilityprivilege-escalation