---
id: CVE-2026-97064
title: >-
  X-SpringBoot through 6.0 ships with a hardcoded static master login
  verification code 172839 enabled by default in the database seed
summary: >-
  X-SpringBoot through 6.0 ships with a hardcoded static master login
  verification code 172839 enabled by default in the database seed.
  Unauthenticated attackers can authenticate as any user by submitting the
  public master code to the emai…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-1392
vendor: yzcheng90
product: X-SpringBoot
affected:
  - X-SpringBoot <= 6.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:17:59.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97064'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/yzcheng90/X-SpringBoot'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/doc/x_springboot.sql#L147
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L112
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-static-master-code
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T19:15:39.036Z'
---

## Overview

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.