X‑SpringBoot, up to version 6.0, returns login verification codes for mobile and email addresses in the HTTP responses of two unsecured endpoints, GET /sys/mobile/code and GET /sys/email/code. An attacker can request a code using a target’s known mobile number or email, read the code from the response, and then authenticate as that user by POSTing the code to /sys/emailOrMobileLogin/login. The vulnerability allows an unauthenticated attacker to hijack accounts and gain full user‑level access. The weakness is a classic authentication bypass (CWE‑287).

The product affected is X‑SpringBoot from the vendor yzcheng90. All releases up to and including version 6.0 are vulnerable, as the insecure endpoints exist in those builds. Users running any of these versions should evaluate their deployment for the presence of the /sys/mobile/code and /sys/email/code paths.

The CVSS score of 9.3 places the vulnerability in the high severity range. EPSS is not available, so the contemporary likelihood of exploitation cannot be quantified, but the lack of authentication on the endpoints and the trivial nature of the request and response patterns mean that the attack can be performed by anyone with network access to the application. The vulnerability is not yet listed in the CISA KEV catalog, yet the potential impact remains significant, as account takeover leads to compromise of user data and system control.