CVE-2026-97064 describes a critical vulnerability in the X-SpringBoot product by yzcheng90, affecting all versions up to 6.0 inclusive. The product ships with a hardcoded static master login verification code (172839) embedded in the database seed and enabled by default. Attackers can exploit this by submitting the master code to the emailOrMobileLogin endpoint along with a known email or mobile number, allowing them to authenticate as any user without needing valid credentials. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

The vulnerability allows complete authentication bypass for any user account if the attacker knows the email or mobile number associated with that account. This can lead to unauthorized access to user data and potentially full account takeover. The critical CVSS score reflects the high risk of exploitation and impact on confidentiality and integrity of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the hardcoded master login verification code if possible, or restrict access to the affected endpoint. Monitor vendor communications for an official patch or update addressing this issue.