The vulnerability in X-SpringBoot through version 6.0 involves unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code returning login verification codes in HTTP responses instead of sending them securely to account owners. Attackers can exploit this by requesting codes for known mobile numbers or email addresses, reading the codes from the responses, and then using the POST /sys/emailOrMobileLogin/login endpoint to authenticate as the victim, effectively hijacking accounts. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Attackers can hijack user accounts by obtaining login verification codes directly from unauthenticated HTTP responses. This compromises account confidentiality and integrity, allowing unauthorized access without needing prior credentials or interaction from the victim.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoints or implement additional authentication controls to prevent unauthorized retrieval of verification codes.