CVE-2026-97063: X-SpringBoot Authentication Bypass via Leaked Verification Codes — Detection and Remediation Guide

NVD has published CVE-2026-97063, a CVSS 9.1 (Critical), remotely and network-exploitable vulnerability in X-SpringBoot versions through 6.0. The flaw is one of the most operationally dangerous classes of authentication weaknesses we see in incident response: the application generates one-time login verification codes and returns them directly in the HTTP response body to unauthenticated callers — without ever delivering the code to the legitimate account owner via SMS or email.

The practical impact is total account takeover against any user whose mobile number or email address an attacker knows. No brute force, no password spraying, no social engineering — just three HTTP requests. X-SpringBoot is a widely deployed Spring-based rapid-development scaffold used for admin consoles and backend management systems, and internet-facing deployments are trivially enumerable. If you operate any X-SpringBoot-based application exposed to the network, treat this as an active-triage item today: inventory exposure, apply compensating controls immediately, and hunt for historical exploitation.

Technical Analysis

Affected Product and Versions

• Product: X-SpringBoot (Spring Boot-based rapid development platform)
• Versions: All releases through 6.0
• CVE: CVE-2026-97063
• CVSS v3.1: 9.1 (Critical) — attack vector NETWORK, no authentication required, no user interaction
• Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-97063

How the Vulnerability Works

The flaw lives in the verification-code issuance flow for password-less login. The attack chain from a defender's perspective:

1. Code request (unauthenticated): The attacker issues GET /sys/mobile/code?mobile=<victim_number> or GET /sys/email/code?email=<victim_email>. Neither endpoint requires a session or any proof of possession of the target account.
2. Code disclosure in the response: Instead of (or in addition to) sending the OTP to the victim via SMS/email gateway, the server returns the verification code in the HTTP response to the requester. The attacker simply reads it.
3. Account takeover: The attacker submits the stolen code to POST /sys/emailOrMobileLogin/login with the victim's identifier and receives an authenticated session — full account hijack, including administrative accounts if the victim has elevated roles.

This is a textbook CWE-200 (Exposure of Sensitive Information) compounded by broken OTP delivery design (CWE-287, Improper Authentication). Because the codes never reach the victim, users receive no notification artifact that an attack occurred — there are no suspicious SMS messages to tip anyone off. The only reliable forensic evidence is in web/access logs and application audit trails.

Exploitation Status

The vulnerability is remotely exploitable with trivial complexity — the entire attack is three HTTP requests that can be executed with curl. At publication, check the NVD entry and CISA's Known Exploited Vulnerabilities catalog for current exploitation status. Regardless of confirmed in-the-wild activity, a 9.1 network-exploitable auth bypass of this simplicity should be treated as probable imminent exploitation, particularly against internet-facing admin panels. Assume scanners will enumerate the /sys/mobile/code and /sys/email/code endpoints within days of public disclosure.

Detection & Response

The most reliable detection surface is your web access logs (reverse proxy, load balancer, WAF, or the embedded servlet container logs). The malicious pattern is highly distinctive: requests to the code-generation endpoints followed by logins via /sys/emailOrMobileLogin/login. Legitimate traffic to these endpoints exists, so the highest-fidelity signal is response-size anomalies and request-to-login correlation — and, where possible, inspection of response bodies containing codes.

Sigma Rules

---
title: X-SpringBoot Unauthenticated Verification Code Request - CVE-2026-97063
id: 3f8c2a1e-6b4d-4e9a-b7c1-9d2e5f8a3c6b
status: experimental
description: Detects requests to X-SpringBoot verification code endpoints that disclose OTPs in HTTP responses, a key step in CVE-2026-97063 account takeover attacks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97063
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - '/sys/mobile/code'
      - '/sys/email/code'
  condition: selection
falsepositives:
  - Legitimate user login flows requesting verification codes (tune by alerting on volume, source reputation, or correlation with subsequent logins)
level: medium
---
title: X-SpringBoot Verification Code Request Followed by Passwordless Login - CVE-2026-97063
id: 8d1e4b72-3c5f-4a8d-9e2b-6f4a1c7d5e9a
status: experimental
description: Detects POST requests to the X-SpringBoot emailOrMobileLogin endpoint, which completes account takeover when chained with leaked verification codes from CVE-2026-97063. High priority when the same source IP previously hit the code endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97063
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains: '/sys/emailOrMobileLogin/login'
    cs-method: 'POST'
  condition: selection
falsepositives:
  - Legitimate passwordless logins (correlate with preceding code requests from the same source and unusual geolocation/ASN to raise fidelity)
level: high
---
title: High-Volume X-SpringBoot Verification Code Enumeration - CVE-2026-97063
id: 5a9f3c6d-1e7b-4d2a-8c4f-2b6e9a1d3f5c
status: experimental
description: Detects bulk requests to X-SpringBoot code endpoints from a single source, indicating enumeration of victim mobile numbers or email addresses for mass account takeover via CVE-2026-97063.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97063
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - '/sys/mobile/code'
      - '/sys/email/code'
  condition: selection | count(c-ip) by c-uri > 10
timeframe: 5m
falsepositives:
  - Load balancer health checks (typically not directed at these URIs); QA automation
level: high

KQL — Microsoft Sentinel Hunt

This query assumes your web/proxy logs are ingested into CommonSecurityLog (CEF from WAF/proxy) or a custom web log table. It correlates code-endpoint requests with subsequent passwordless logins from the same source within a 10-minute window — the exact CVE-2026-97063 attack chain.

let lookback = 24h;
let window = 10m;
let CodeRequests =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has_any ("/sys/mobile/code", "/sys/email/code")
    | project CodeTime=TimeGenerated, SourceIP, RequestURL, DeviceVendor;
let Logins =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestURL has "/sys/emailOrMobileLogin/login" and RequestMethod == "POST"
    | project LoginTime=TimeGenerated, SourceIP, RequestURL;
CodeRequests
| join kind=inner Logins on SourceIP
| where LoginTime between (CodeTime .. CodeTime + window)
| summarize CodeRequestCount=count(), FirstCodeRequest=min(CodeTime), LastLogin=max(LoginTime),
    CodeURLs=make_set(RequestURL_CodeRequests), LoginURLs=make_set(RequestURL_Logins) by SourceIP
| order by CodeRequestCount desc

For environments forwarding raw Syslog from the application host or reverse proxy:

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("/sys/mobile/code", "/sys/email/code", "/sys/emailOrMobileLogin/login")
| extend Uri = extract(@'(GET|POST)\s+(/sys/[^\s\"]+)', 2, SyslogMessage)
| summarize Requests=count(), DistinctUris=dcount(Uri), Uris=make_set(Uri) by HostIP, Computer, bin(TimeGenerated, 5m)
| where Requests > 5 or DistinctUris > 1
| order by Requests desc

Velociraptor VQL — Retro-Hunt Access Logs on Application Hosts

Use this artifact to sweep X-SpringBoot hosts and reverse proxies for historical evidence of exploitation in local access logs (adjust the glob to your Nginx/Apache/Tomcat log paths):

-- Hunt access logs for CVE-2026-97063 exploitation patterns on X-SpringBoot hosts
SELECT FullPath AS LogFile,
       Line AS LogLine,
       parse_string_with_regex(string=Line,
         regex='(?P<SrcIP>\d+\.\d+\.\d+\.\d+)').SrcIP AS SourceIP
FROM foreach(
  row={
    SELECT FullPath
    FROM glob(globs=['/var/log/nginx/*.log', '/var/log/apache2/*.log', '/var/log/httpd/*.log', '/opt/*/logs/*.log'])
  },
  query={
    SELECT FullPath, Line
    FROM parse_lines(filename=FullPath)
    WHERE Line =~ '/sys/(mobile|email)/code|/sys/emailOrMobileLogin/login'
  })

Remediation / Exposure Verification Script

Run this Bash script on X-SpringBoot hosts or their fronting reverse proxies to (1) verify whether the vulnerable endpoints are reachable, (2) check logs for prior exploitation, and (3) emit a ready-to-apply Nginx block snippet as an emergency compensating control:

#!/bin/bash
# CVE-2026-97063 exposure check and retro-hunt for X-SpringBoot deployments
TARGET="${1:-http://127.0.0.1}"
LOG_DIRS=("/var/log/nginx" "/var/log/apache2" "/var/log/httpd" "/opt")

echo "[*] Testing endpoint exposure against ${TARGET}"
for path in "/sys/mobile/code?mobile=10000000000" "/sys/email/code?email=test@example.com"; do
  resp=$(curl -sk -o - -w "HTTP_STATUS:%{http_code}" "${TARGET}${path}")
  echo "--- ${path}"
  echo "${resp}" | tail -c 500
  # CRITICAL FINDING: response body contains a verification code
  if echo "${resp}" | grep -Eq '"?code"?\s*[:=]\s*"?[0-9]{4,8}'; then
    echo "[!!] VULNERABLE: verification code appears to be disclosed in response body"
  fi
done

echo "[*] Searching access logs for exploitation indicators"
for dir in "${LOG_DIRS[@]}"; do
  [ -d "$dir" ] && grep -rEh "GET /sys/(mobile|email)/code|POST /sys/emailOrMobileLogin/login" "$dir" 2>/dev/null | tail -n 50
done

cat <<'EOF'
[*] Emergency Nginx compensating control (apply while awaiting patch):

location ~ ^/sys/(mobile|email)/code {
    deny all;
    return 403;
}
location = /sys/emailOrMobileLogin/login {
    deny all;
    return 403;
}
# Reload with: nginx -t && systemctl reload nginx
EOF

Warning on testing: requesting a code against a production instance may invalidate an in-progress legitimate code or trigger rate limits. Test against staging where possible, and never submit a code to the login endpoint against an account you do not own.

Remediation

1. Upgrade X-SpringBoot immediately. Monitor the project's repository and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-97063) for the fixed release superseding 6.0. Treat this with the same urgency as an internet-facing RCE — unauthenticated account takeover of admin consoles is functionally equivalent in impact.
2. Block the vulnerable endpoints at the edge while awaiting a patch. Use the Nginx snippet above, or equivalent WAF/reverse-proxy rules, to deny external access to /sys/mobile/code, /sys/email/code, and /sys/emailOrMobileLogin/login. If passwordless login is business-critical, restrict these paths to trusted source networks only.
3. Disable passwordless OTP login if it is not required. Enforce password + MFA (TOTP or WebAuthn) instead of SMS/email codes. This eliminates the vulnerable flow entirely.
4. Hunt retroactively. Run the Sigma, KQL, and VQL content above across at least 90 days of retained access logs. Any code request followed by a login from the same source — especially from hosting providers, VPN exits, or foreign ASNs — warrants full IR scoping of that account.
5. Force credential and session resets for any suspect accounts. Invalidate all active sessions and tokens (JWT signing keys if applicable) for accounts implicated in suspicious logins, because a hijacked session persists independently of the OTP flow.
6. Verify OTP delivery design post-patch. Confirm the fixed version sends codes exclusively via the SMS/email gateway and returns only a generic success message (e.g., {"success": true}) with no code material in the response body. Add a regression test asserting codes never appear in HTTP responses.
7. Check CISA KEV and vendor advisories on publication. If CVE-2026-97063 is added to the Known Exploited Vulnerabilities catalog, federal civilian agencies face a binding remediation deadline under BOD 22-01, and private-sector organizations should adopt the same date as their internal SLA.

Bottom Line

CVE-2026-97063 is a design-level authentication failure with a three-request exploitation path and no victim-side warning signal. The only places this attack reliably shows up are your web logs and session telemetry — which means detection engineering and edge-level compensating controls carry the full defensive burden until you patch. Inventory your X-SpringBoot exposure today, block the endpoints at the perimeter, hunt back 90 days, and force session invalidation for anything suspicious.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub