CyberRota Analysis
AI-GeneratedX-SpringBoot versions up to 6.0 are vulnerable as they expose login verification codes through unauthenticated HTTP endpoints, allowing attackers to request and intercept these codes using known mobile numbers or email addresses. This critical vulnerability enables unauthorized account access, leading to potential account hijacking. Organizations using X-SpringBoot should prioritize patching this issue to protect user accounts from exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.