EUVD-2026-87253Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed X-SpringBoot instance
-
DeliveryGET /application/manager/select unauthenticated
-
ExploitRead appKey/appSecret from response
-
ExecutionAuthenticate to tenant SMS provider with stolen keys
-
ImpactSend arbitrary/bombing/impersonation SMS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of X-SpringBoot (yzcheng90) through version 6.0; the GET /application/manager/select endpoint is exposed without authentication and returns appKey/appSecret without field filtering. The only practical prerequisite is network reachability to the application. Downstream SMS abuse additionally requires that the affected tenant has a functional/funded SMS provider configured, and real damage is limited to actions those SMS credentials permit (message sending, cost abuse, impersonation) rather than broader system compromise. |
| Impact | This is a genuine, easy-to-exploit issue but with bounded direct impact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, base 6.9) describes fully remote, unauthenticated, low-complexity access with no user interaction - the endpoint GET /application/manager/select simply returns appKey/appSecret with no auth and no field filtering (CWE-306). Publicly available exploit code exists (a VulnCheck-referenced Python PoC on GitHub), so the barrier to abuse is effectively zero, which raises real-world urgency above the raw score. The primary technical impact is confidentiality (credential disclosure), and the confidentiality/integrity metrics are correctly rated Low rather than High because the leaked secrets are tenant SMS-provider credentials, not full system control: the follow-on impact is SMS bombing, impersonation, and provider-cost abuse rather than data-store compromise or RCE. No EPSS score, KEV listing, or SSVC decision data was provided, so widespread-exploitation probability cannot be quantified from the input; the combination of a public PoC plus an obscure product suggests opportunistic/targeted rather than mass exploitation. Note the 'Authentication Bypass' tag is loose - the real weakness is a missing-authentication credential exposure (info-disclosure) leading to downstream abuse, not a session/authn circumvention. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single GET request to /application/manager/select on an internet-exposed X-SpringBoot instance and receives each tenant's appKey and appSecret in the response body. Using those credentials the attacker drives the tenant's SMS provider to blast SMS messages (bombing) or send spoofed messages impersonating the tenant. A public Python PoC demonstrating this credential-to-SMS-abuse chain is available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated credential disclosure in X-SpringBoot (yzcheng90) through version 6.0 allows remote attackers to read tenant appKey and appSecret values from the GET /application/manager/select endpoint, which performs no authentication check and applies no field filtering to the response. With those credentials an attacker can drive the affected tenant's configured SMS provider to send arbitrary messages, enabling SMS bombing, cost abuse, and impersonation of the legitimate application. The issue is trivially exploitable - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (vendor score 6.9 under CVSS 4.0) - and publicly available exploit code exists in a GitHub PoC repository; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis. Direct impact is bounded: the disclosure affects SMS credentials and message-sending capability rather than full system compromise.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be compensating controls until upstream or a fork supplies a fix. Immediately block public access to the management API surface: restrict /application/manager/** (in particular GET /application/manager/select) at the reverse proxy, WAF, or Spring Security filter chain so that only trusted administrative networks or authenticated sessions can reach it - the trade-off is that the application management UI becomes unreachable for remote administrators until they are placed on the allow-list or given a session. Encrypt-at-rest does not help here, so the highest-priority action is credential rotation: treat every appKey/appSecret returned by that endpoint as compromised, revoke and reissue them at the SMS provider, and configure provider-side spend caps, per-day message quotas, and sender-ID/signature whitelists so a leaked key cannot be used for bulk SMS bombing or brand impersonation (rate limits may delay legitimate bulk notifications). If the source tree is under your control, add a projection that omits appKey/appSecret from the select response, enforce authentication on the controller, and redeploy; the referenced source at https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64 identifies exactly which handler to modify. Monitor SMS provider logs for unexpected send volume or destination numbers, review the advisory at https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint for updates, and note that public exploit code (https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py) makes opportunistic scanning likely, so patching or blocking should be prioritized over detection-only measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
X-SpringBoot is a Java/Spring Boot-based rapid-development framework (the upstream repository is github.com/yzcheng90/X-SpringBoot) whose application-management module exposes administrative functionality under the /application/manager path. The vulnerable handler is XApplicationController (lines ~59-64 of the referenced source file), which returns application configuration records - including the SMS provider appKey and appSecret - directly from a data-access select call without field projection and without any authentication or authorization guard, mapping to CWE-306 (Missing Authentication for Critical Function). The appKey/appSecret pair is the credential set used to authenticate against a third-party SMS gateway (for example Aliyun or Tencent Cloud SMS), so its disclosure effectively hands the attacker the tenant's ability to bill and send messages through that provider. The affected product is tracked as CPE cpe:2.3:a:yzcheng90:x-springboot:*:*:*:*:*:*:*:* and as EUVD-2026-87253, with all versions from 0 up to and including 6.0 listed as affected. Because the endpoint is reachable on the application's normal HTTP listener and requires no session, the vulnerability is a classic unauthenticated information-disclosure pattern in which a management API is deployed alongside the public application surface.
Know when X Springboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Unauthenticated remote GET with no interaction (PR:N/UI:N/AV:N/AC:L); C:L for credential disclosure and I:L for enabled SMS spoofing/abuse; no direct availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in X Springboot
View allUnauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by subm
X-SpringBoot through 6.0 allows remote unauthenticated attackers to hijack user accounts by abusing unauthenticated endp
Authenticated privilege escalation in X-SpringBoot through 6.0 lets any account with delegated user-management permissio
This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (R
Exploit-DB