Summary
X-SpringBoot exposes login verification codes through unauthenticated mobile- and email-code endpoints instead of delivering them only to account owners. An attacker who knows a victim's phone number or email address may retrieve the code and use it to authenticate as the victim, potentially taking over the account.
Affected context
The vulnerability occurs in X-SpringBoot deployments through version 6.0 when the verification-code endpoints accept unauthenticated requests and include generated codes in their HTTP responses. The risk is present where the returned codes can be used by the login flow without an independent proof that the requester controls the associated mobile number or email account.
Exploit preconditions
- Attack surface: Unauthenticated HTTP endpoints that generate mobile or email login codes
- Required access: Knowledge of a target account's mobile number or email address; no prior authenticated session may be required
- Trigger point: Requests to the verification-code endpoints followed by the passwordless login workflow
- Why exploitation is possible: The server returns authentication material directly to an unauthenticated requester without verifying control of the destination account
Why this happens
The underlying issue is an improper authentication design in which a verification factor is exposed to the party requesting it rather than being securely delivered to and validated through the account owner's communication channel. This behavior maps to CWE-287: Improper Authentication, because the login process accepts a code obtained without establishing that the requester controls the claimed identity or associated contact method.
Potential impact
- Attackers may authenticate as targeted users
- Victim accounts could be taken over
- Sensitive personal or business data may be exposed
- Attackers could change account settings or recovery details
- Compromised accounts may be used for fraud, abuse, or lateral access
General mitigation guidance
Mitigation generally focuses on ensuring that authentication codes are never disclosed through the initiating HTTP response and that login factors are bound to verified delivery channels.
Common defensive patterns include:
- Delivering codes only through the intended email or mobile channel
- Returning generic responses that do not reveal authentication secrets or account state
- Requiring proof of control over the destination channel before accepting a login code
- Binding codes to a short-lived authentication transaction, client context, and intended account
- Enforcing expiration, single use, rate limits, and abuse monitoring for code requests
- Applying least privilege to account recovery and post-login operations
- Requiring stronger authentication for sensitive actions or account recovery changes
How teams detect issues like this
Organizations can assess this class of issue through:
- Dynamic testing to confirm that unauthenticated code requests never return usable verification secrets
- API review for endpoints that generate, return, or validate login factors
- Static analysis and code review searches for response paths containing OTPs, verification codes, or equivalent secrets
- Policy checks requiring authentication factors to be delivered out of band and validated against a server-side transaction
- Monitoring for repeated code requests, unusual target enumeration, and successful logins following anomalous requests
- Automated security review tools that flag authentication secrets returned in API responses
