CVE-2026-97063 is an authentication flaw in X-SpringBoot through version 6.0, rated 9.1. Two unauthenticated endpoints return the login verification code in the HTTP response instead of only sending it to the account owner. The record names no fixed version, so mitigate now and watch the project.
What's affected
- Product: X-SpringBoot, a Spring Boot based application framework, through version 6.0.
- Affected: all versions through 6.0.
- Fixed version: none is named in the record or in the VulnCheck advisory. Check the project repository for a fix before relying on one.
- Endpoints: the mobile code and email code endpoints under /sys, and the email or mobile login endpoint that accepts the code.
How to check if you're exposed
If you run X-SpringBoot, or an application built from it, check your version and whether the code endpoints are reachable. Look in your access logs for requests to the code endpoints that come from outside your own front end:
grep -E '/sys/(mobile|email)/code' /var/log/your-app/access.log
A burst of code requests followed by a login from the same address is the pattern to look for. If your fork or copy changed those controllers, review the code to see whether the verification code is still returned in the response.
What to do now
- Stop returning the code in the response. The code should only go to the phone number or email address through your messaging provider.
- Until you can change the code, block or disable the mobile and email login flow at your gateway or reverse proxy.
- Add rate limiting and a short expiry to verification codes, and invalidate a code after one use.
- Review recent sign ins that used the code login, and reset sessions for any accounts you cannot account for.
- Track the project repository for an official fix and apply it when it lands.
Why it matters
The record lists CWE-287, improper authentication. A verification code only proves that you control a phone or mailbox if it is delivered there. When the same code is handed back to whoever asks, knowing a phone number or email address is enough to sign in as that person.
The vector is network based, needs no privileges and no user action, with high confidentiality and integrity impact, which explains 9.1. The VulnCheck advisory and the record do not state that this is exploited in the wild, and it is not in the CISA KEV list according to the record.
Quick check
Will two factor authentication protect me here?
Only if the second factor is not the same flow. If the code login is the primary or only path, the flaw lets an attacker skip it entirely.
Sources
Last reviewed: 19 October 2026.
