A critical authentication bypass vulnerability in X-SpringBoot versions 6.0 and earlier allows unauthenticated attackers to hijack any user account by intercepting verification codes returned in plain text.

The application improperly handles verification codes by returning them directly in the HTTP response body for the endpoints GET /sys/mobile/code and GET /sys/email/code. An unauthenticated attacker can request a code for any known mobile number or email address, retrieve the code from the server response, and use it to authenticate as the victim via the POST /sys/emailOrMobileLogin/login endpoint.

This vulnerability poses a severe risk to organizational security by enabling full account takeover without requiring credentials or interaction from the legitimate user. Given the CVSS score of 9.1, this flaw is categorized as critical because it facilitates unauthorized access to sensitive user data and internal system functions. Successful exploitation could lead to widespread data breaches, loss of system integrity, and significant reputational damage.

Immediate Action: Update X-SpringBoot to the latest secure version immediately. If an official patch is not yet available, organizations should restrict access to the affected endpoints at the network or application firewall level.

Proactive Monitoring: Review application access logs for unusual patterns, such as a high volume of requests to /sys/mobile/code or /sys/email/code from single source IPs. Monitor for successful logins originating from suspicious or unexpected locations.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the identified vulnerable endpoints. Ensure that sensitive authentication traffic is monitored for anomalous behavior.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the linked research writeup on GitHub.

The critical nature of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Security teams must prioritize patching or isolating the affected X-SpringBoot instances to prevent unauthorized account takeovers. Failure to mitigate this issue exposes the organization to significant risk of data compromise and unauthorized administrative access.