Description
A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| macrozheng | mall | 1.0.0, 1.0.1, 1.0.2, 1.0.3 | — |
References
- VDB-416564 | macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration vdb-entry technical-description
- VDB-416564 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-108785 | CVE Analysis and Report third-party-advisory
- Submit #959284 | macrozheng mall 1.0.3 CWE-613: Insufficient Session Expiration third-party-advisory
- https://github.com/macrozheng/mall/issues/997 exploit issue-tracking
- https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a patch
- https://github.com/macrozheng/mall/ product