PT-2026-6933 · Unknown · Macrozheng Mall

Lennon Chia · Publicado 2026-02-07 · Atualizado 2026-03-05 · CVE-2026-25858

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macrozheng mall versions prior to 1.0.4

Description The software contains an authentication issue in the password reset process. An unauthenticated attacker can reset user account passwords using only a victim’s telephone number. The one-time password (OTP) is exposed in the API response and password reset requests are validated by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This allows for remote account takeover of any user with a known or guessable telephone number. The vulnerable API endpoint is the password reset flow within the mall-portal. The vulnerability exploits the lack of verification of user identity and telephone number ownership during password reset requests.

Recommendations Update macrozheng mall to version 1.0.4 or later.

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2026-25858

Produtos afetados

Macrozheng Mall

Referências · 8

• https://github.com/macrozheng/mall/issues/946 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25858 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25858 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2020261625740029971 · Publicação no Twitter
• https://vulncheck.com/advisories/macrozheng-mall-unauthenticated-password-reset-via-otp-disclosure · Nota
• https://t.me/cveNotify/154398 · Publicação no Telegram
• https://t.me/CVEtracker/44063 · Publicação no Telegram
• https://macrozheng.com · Nota