CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 25, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 25, 2026
Description
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
X-SpringBootyzcheng90 |
|
References
- Proof of conceptexploit
- Vulnerable codetechnical-description
- https://github.com/yzcheng90/X-SpringBootproduct
- VulnCheck Advisory: X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.