The X‑SpringBoot application exposes application credentials—appKey and appSecret—through the GET /application/manager/select endpoint without requiring authentication or filtering. An unauthenticated attacker can retrieve these credentials and forward arbitrary SMS messages via any tenant’s SMS provider, enabling SMS bombing and impersonation attacks, which compromise the confidentiality and integrity of communications.

This vulnerability affects the X‑SpringBoot product (version 6.0 and earlier). The issue was reported for releases up to version 6.0 inclusive. Vendors should verify that they are running 6.0.x or earlier and plan for an upgrade or mitigation.

The vulnerability receives a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, so the current exploit probability is unknown. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by making unauthenticated HTTP GET requests to /application/manager/select; no authentication or special configuration is required, making the attack path straightforward and readily repeatable.