CVE-2026-11521

Vulnerability

A security vulnerability exists in Mohammed-eid35 bank-management-system-springboot up to commit 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. The TransactionController.java component, specifically the /transaction/deposit and /transaction/withdraw endpoints, fails to enforce authentication and authorization checks. This allows unauthenticated requests to reach these critical transaction endpoints because the Spring Security configuration permits access to /transaction/** without proper validation [1]. The project uses a rolling release model, so specific affected and updated versions are not detailed [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attacker needs to know a valid card_number to initiate a deposit or a valid card_number and cvv to initiate a withdrawal. The backend does not verify the user's identity or account ownership, directly processing transactions based on these provided identifiers. The exploit involves sending POST requests to the /transaction/deposit or /transaction/withdraw endpoints with the necessary card details [1].

Impact

Successful exploitation allows an attacker to perform unauthorized deposits and withdrawals on behalf of any user whose card number and potentially CVV are known. This directly impacts the confidentiality and integrity of user accounts, leading to financial loss and unauthorized modification of account balances. The scope of the compromise is limited to the accounts for which the attacker possesses the required identifiers [1].

Mitigation

As of the available references, no specific patched version or release date has been disclosed. The project was informed of the issue early but has not yet responded. There are no workarounds mentioned, and the product's rolling release model means specific version details are unavailable. The vulnerability has been publicly disclosed and may be actively exploited [1, 2].