Home

Description

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.

PUBLISHED Reserved 2026-02-06 | Published 2026-02-07 | Updated 2026-02-10 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Product status

Default status
unknown

Any version
affected

Credits

Lennon Chia finder

References

github.com/macrozheng/mall/issues/946 issue-tracking

www.macrozheng.com/ product

www.vulncheck.com/...cated-password-reset-via-otp-disclosure third-party-advisory

cve.org (CVE-2026-25858)

nvd.nist.gov (CVE-2026-25858)

Download JSON