CVE-2026-97064

CVSS 9.3 (critical) · published 2026-09-25

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.

Weakness: CWE-1392

Source: NVD CVE-2026-97064

References

• https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.py
• https://github.com/yzcheng90/X-SpringBoot
• https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/doc/x_springboot.sql#L147
• https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L112
• https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-static-master-code

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.