This vulnerability in macrozheng mall 0504e86 involves a flaw in the /sso/getAuthCode endpoint of the mall-portal module that leads to weak password recovery mechanisms. The vulnerability can be exploited remotely without authentication or user interaction, but the attack complexity is high, making exploitation difficult. Although an exploit has been published, there is no official vendor response or patch available. The vendor deleted the related GitHub issue and did not respond to early disclosure emails.

Successful exploitation could allow an attacker to bypass secure password recovery processes, potentially leading to unauthorized account access. However, the high attack complexity and lack of known exploits in the wild reduce the immediate risk. The vulnerability does not require privileges or user interaction, increasing theoretical exposure, but practical exploitation is difficult.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected endpoint if possible or implementing additional authentication controls around password recovery.