Executive brief
A security flaw in the Bank Management System allows unauthorized individuals to perform financial transactions. The software, which manages banking operations like deposits and withdrawals, fails to properly verify user identity for certain requests. This means an attacker could potentially move funds or modify account balances without being logged in, provided they have basic account details like a card number.
Technical details
The application's TransactionController component suffers from improper authorization (CWE-285) due to a misconfiguration in SecurityConfiguration.java. The '/transaction/**' path is explicitly allowed in the Spring Security permitAll() configuration, bypassing authentication requirements. Consequently, the backend processes deposit and withdrawal requests based solely on identifiers (card_number and CVV) provided in the request body without verifying the session identity or account ownership. A remote attacker can exploit this to perform unauthorized financial operations. As of the advisory date, the project has not responded to the issue report.
Affected products
- Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948
Timeline
- 2026-05-24: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: CVE published and NVD record created