CVE-2026-108785— macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
Quick assessment
Affected
macrozheng mall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 macrozheng mall 1.0.3 及以下版本中发现了一个安全漏洞。该漏洞影响 组件中 路径下的 函数。对参数 token 的恶意操作会导致会话（session）过期。该漏洞可被远程利用，且相关利用代码已公开，可被直接利用。补丁哈希值为：9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a。建议部署该补丁以修复此漏洞。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| macrozheng | mall | 1.0.0 |
affected |
1.0.1 |
affected | ||
1.0.2 |
affected | ||
1.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108785
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| macrozheng | mall | 1.0.0 |
cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108785
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108785
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108785 (1)
Vendor Pages for CVE-2026-108785 (1)
Other References for CVE-2026-108785 (1)
-
🔗 账号封禁机制失效：已登录 Token 在账号被禁用后仍保持有效 · Issue #997 · macrozheng/mall Read full article exploit issue-tracking
IV. Related Vulnerabilities
Same product: mall
-
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java Alip -
CVE-2026-82423
macrozheng mall Payment Status Endpoint paySuccess behaviora -
CVE-2026-82364
macrozheng mall Order Submission submit race condition -
CVE-2026-79406
macrozheng mall quantity OmsCartItemServiceImpl.updateQuanti -
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery
Same vendor: macrozheng
-
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java Alip -
CVE-2026-82423
macrozheng mall Payment Status Endpoint paySuccess behaviora -
CVE-2026-82364
macrozheng mall Order Submission submit race condition -
CVE-2026-79406
macrozheng mall quantity OmsCartItemServiceImpl.updateQuanti -
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery
Same weakness: CWE-613
-
CVE-2026-84321
Nginx UI: Standalone short tokens survive administrative rev -
CVE-2026-109362
Heym v0.0.5 before v0.0.113 Broken Access Control via Workfl -
CVE-2026-109320
Grav API Plugin before 1.0.36 Disabled Account Session Acces -
CVE-2026-109289
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation v -
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication
V. Comments for CVE-2026-108785
No comments yet