CVE-2026-100192

X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

Published Sep 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.

Analysis

Technical impact

The X‑SpringBoot application exposes application credentials—appKey and appSecret—through the GET /application/manager/select endpoint without requiring authentication or filtering. An unauthenticated attacker can retrieve these credentials and forward arbitrary SMS messages via any tenant’s SMS provider, enabling SMS bombing and impersonation attacks, which compromise the confidentiality and integrity of communications.

Affected Systems

This vulnerability affects the X‑SpringBoot product (version 6.0 and earlier). The issue was reported for releases up to version 6.0 inclusive. Vendors should verify that they are running 6.0.x or earlier and plan for an upgrade or mitigation.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, so the current exploit probability is unknown. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw by making unauthenticated HTTP GET requests to /application/manager/select; no authentication or special configuration is required, making the attack path straightforward and readily repeatable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

yzcheng90

X-SpringBoot

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.0

No data.

Vendor Product Versions

Yzcheng90

X-springboot

Version	Status	Scheme	Platform
`[0,6.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade X‑SpringBoot to the latest release (≥ 6.1) where the credential exposure is fixed.
Restrict access to the /application/manager/select endpoint so only authenticated requests are allowed, e.g., by configuring firewall rules or adding authentication middleware.
Monitor outgoing SMS traffic for abnormal volumes and apply rate limiting or content filtering to prevent abuse.

Generated by OpenCVE AI on September 25, 2026 at 19:47 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.320% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py
https://github.com/yzcheng90/X-SpringBoot
https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64
https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint

History

Sep 29, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Yzcheng90 Yzcheng90 x-springboot
Vendors & Products		Yzcheng90 Yzcheng90 x-springboot

Sep 25, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Title		X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
Weaknesses		CWE-306
References		https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py https://github.com/yzcheng90/X-SpringBoot https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64 https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`