X‑SpringBoot releases up to version 6.0 contain a hard‑coded master login code, 172839, which is enabled by default in the database seed. An attacker who has not yet authenticated can supply a known email or mobile number to the emailOrMobileLogin API endpoint along with this master code and receive a valid session, effectively authenticating as any user. This flaw allows full credential compromise and impersonation, granting the attacker control over any account in the system. The weakness is a static master code bypass (CWE‑1392).

All installations of X‑SpringBoot from the initial release through version 6.0, maintained by vendor yzcheng90, are affected. The vulnerability exists in every build that ships with the default seed data containing the static master verification code.

The CVSS score of 9.3 indicates critical severity. No EPSS score is available, but the lack of an exploit probability metric does not diminish that the flaw is trivially exploitable via a simple HTTP request to the public login endpoint. The vulnerability is not listed in the CISA KEV catalog, yet the straightforward attack path and huge impact mean that the risk remains very high. The likely attack vector is unauthenticated request to the emailOrMobileLogin endpoint, which will succeed for any valid user identifier.