Vulnerability Description
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-cr
- https://github.com/yzcheng90/X-SpringBoot
- https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7
- https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposur
FAQ
What is CVE-2026-100192?
CVE-2026-100192 is a vulnerability with a CVSS score of 6.5 (MEDIUM). X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve thes...
How severe is CVE-2026-100192?
CVE-2026-100192 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100192?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.