CVE-2026-100192 yzcheng90 CVE debrief

Who should care

Defenders responsible for X-SpringBoot deployments, security teams monitoring for credential exposure, and administrators of SMS providers should assess exposure and prioritize remediation.

Why it matters

CVE-2026-100192 is a medium-severity vulnerability that allows unauthenticated attackers to retrieve sensitive credentials and use them for SMS bombing and impersonation attacks. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity.

• Verify exposure of sensitive credentials in your deployment
• Restrict access to the /application/manager/select endpoint
• Monitor for suspicious SMS activity
• Rotate existing credentials and consider additional authentication mechanisms

Technical summary

The vulnerability exists in the X-SpringBoot application, specifically in the GET /application/manager/select endpoint, which exposes appKey and appSecret credentials without authentication or field filtering. This allows unauthenticated attackers to retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks. Defenders should prioritize verifying exposure of the /application/manager/select endpoint, restricting access to sensitive credentials, and monitoring for suspicious SMS activity. Affected product context requires verification of X-SpringBoot deployments, and defensive impact includes potential SMS bombing and

Defensive priority

Defenders should prioritize verifying exposure of the /application/manager/select endpoint, restricting access to sensitive credentials, and monitoring for suspicious SMS activity.

Recommended defensive actions

• Verify exposure of the /application/manager/select endpoint in your deployment
• Restrict access to sensitive credentials and consider rotating existing credentials
• Monitor for suspicious SMS activity and implement additional authentication mechanisms
• Review and update affected versions according to vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the exact scope of affected versions and deployments requires further verification from the vendor and official sources. Affected product deployments need to be confirmed in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.