CVE-2026-108785: Session Expiration in macrozheng mall
Description
CVE-2026-108785 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves a flaw in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, which can cause session expiration due to manipulation of the token argument. The vulnerability can be exploited remotely. A patch identified by commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a is recommended to fix this issue.
CVSS v4.0
Score 5.3medium
Affected software
macrozheng
mall
pkg:github/macrozheng/mallcpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects macrozheng mall up to version 1.0.3 in the JwtAuthenticationTokenFilter component, specifically the JwtTokenUtil.refreshHeadToken function. The flaw allows an attacker to manipulate the token argument, causing session expiration. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 5.3 (medium severity). A patch is available as indicated by the referenced commit hash.
Potential Impact
An attacker can remotely manipulate the token argument to cause session expiration, potentially disrupting user sessions. The impact is limited to session management and does not indicate privilege escalation or data disclosure. The CVSS score of 5.3 reflects a medium severity with network attack vector and low complexity.
Mitigation Recommendations
A patch is available for this vulnerability, identified by commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. It is recommended to deploy this patch to remediate the issue. No additional vendor advisory was provided, so check the official macrozheng project resources for the patch and deployment instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-11T08:29:46.185Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acc39012cdf04f6564d0b7d
Added to database: 10/12/2026, 01:33:53 UTC
Last enriched: 10/12/2026, 01:48:15 UTC
Last updated: 10/12/2026, 01:49:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.