CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
Unauthenticated attackers can retrieve appKey and appSecret credentials from an exposed endpoint, enabling SMS bombing and impersonation attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100192?
CVE-2026-100192 is a medium-severity vulnerability in yzcheng90 X-SpringBoot, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
Weakness: CWE-306
Which versions are affected by CVE-2026-100192?
How do I fix CVE-2026-100192?
No fix has been published for CVE-2026-100192 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100192 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100192 exists.
Sources
Also known as GHSA-w672-5jg3-397x.