Medium severity6.5NVD Advisory· Published Sep 25, 2026
CVE-2026-100192
CVE-2026-100192
Description
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=6.0
Patches
Vulnerability mechanics
References
3- github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.pynvd
- github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.javanvd
- www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpointnvd
News mentions
0No linked articles in our index yet.