Heddazhu

**Name of the Vulnerable Software and Affected Versions** macrozheng mall versions up to 1.0.3 **Description** A problematic issue has been found in the JWT Token Handler component, leading to the use of a default cryptographic key. The complexity of an attack is rather high, and exploitation is known to be difficult. The vendor was contacted about this disclosure but did not respond, and the issue posted on GitHub was deleted without explanation. **Recommendations** For macrozheng mall versions up to 1.0.3, consider disabling the JWT Token Handler component until a patch is available to prevent the use of the default cryptographic key. At the moment, there is no information about a newer version that contains a fix for this vulnerability.