CVE-2026-105237: Improper Restriction of Excessive Authentication Attempts in linlinjava litemall

This vulnerability in linlinjava litemall (versions 1.0 through 1.8.0) affects the login endpoint by failing to properly restrict excessive authentication attempts. The flaw resides in the AdminAuthController.java component of the admin API. It allows remote attackers to perform repeated authentication attempts, potentially facilitating brute force or credential stuffing attacks. The attack complexity is high, and the vulnerability does not require privileges or user interaction. Although the exploit is publicly available, the vendor has not issued a fix or official response.

The improper restriction of excessive authentication attempts can enable attackers to perform brute force or credential stuffing attacks against the login endpoint remotely. This could lead to unauthorized access if valid credentials are discovered. However, the high attack complexity and lack of privileges required reduce the likelihood of widespread exploitation. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, organizations should consider implementing external mitigations such as rate limiting, account lockout policies, or multi-factor authentication to reduce risk until an official patch is available.