CVE-2026-25858

Katalog CVE

CVSS 9.1 · Critical EPSS 1,1%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada macrozheng mall. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.

Rincian

Terbit di NVD

7 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/macrozheng-mall-unauthenticated-password-reset-via-otp-disclosure advisory pihak ketiga · vdb entry
• https://github.com/macrozheng/mall/issues/946 not applicable
• https://www.macrozheng.com/ permissions required