{"id":"CVE-2026-100192","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100192","generatedAt":"2026-10-28T03:59:12.321Z","title":"X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering.","description":"X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.","published":"2026-09-25T19:16:49.000Z","lastModified":"2026-09-29T20:17:09.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.0032,"percentile":0.24796,"date":"2026-10-27","history":[{"date":"2026-09-26","score":0.0032,"percentile":0.22405}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-25T19:16:49.000Z","detail":{"score":"6.9","severity":"MEDIUM","publishedAt":"2026-09-25T19:16:49.230Z"},"summary":"New CVE, medium severity (CVSS 6.9)."}],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100192","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}