CVE-2026-100192
X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
| CWE | CWE-306 |
| Vendor | yzcheng90 |
| Product | x-springboot |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for yzcheng90 x-springboot
Be the first to know when new medium vulnerabilities affecting yzcheng90 x-springboot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
yzcheng90 / X-SpringBoot
0 ≤ 6.0
References
github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py github.com: https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64 github.com: https://github.com/yzcheng90/X-SpringBoot vulncheck.com: https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint
Credits
Yaqi Chao Mingsheng Lin