A critical authentication bypass vulnerability in X-SpringBoot allows unauthenticated attackers to gain unauthorized access to any user account via a hardcoded master verification code.

The application utilizes a hardcoded static master verification code (172839) that is enabled by default in the database seed. Unauthenticated attackers can submit this code to the emailOrMobileLogin endpoint to authenticate as any user without knowing the correct credentials.

Successful exploitation of this vulnerability results in full unauthorized access to user accounts, including administrative accounts. This leads to complete data compromise, potential modification of system configurations, and significant reputational damage. Given the CVSS score of 9.1, this flaw represents a critical risk to the confidentiality and integrity of the entire application environment.

Immediate Action: As no specific patch version is currently identified, administrators must immediately modify the database to remove or change the sys_super_code parameter to a secure, unique value and implement proper rate limiting on the login endpoints.

Proactive Monitoring: Monitor access logs for anomalous authentication requests to the emailOrMobileLogin and sys/mobile/code endpoints, specifically looking for repeated attempts using the master code value.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing the known master code or unauthorized access patterns targeting the authentication controllers.

Public Exploit Available: Yes, a functional proof-of-concept script has been published on GitHub.

This is a critical security failure that permits trivial account takeover. Because a public proof-of-concept exists, the risk of exploitation is high. Organizations currently running X-SpringBoot must treat this as a top-priority remediation task, ensuring the master code is immediately neutralized and access logs are reviewed for any signs of past unauthorized entry.