CVE-2026-25858 is a critical authentication vulnerability in macrozheng mall (version 1.0.3 and prior) affecting the password reset workflow. The vulnerability allows unauthenticated attackers to reset arbitrary user passwords by exploiting the password reset API, which exposes the OTP directly in the response and validates the reset request only by comparing the OTP to a value stored by telephone number. There is no verification of user identity or telephone number ownership, enabling remote attackers to take over accounts if they know or can guess the victim's phone number.

Successful exploitation allows an unauthenticated attacker to reset any user's password remotely, resulting in full account takeover. This compromises user confidentiality, integrity, and availability of accounts on the affected platform. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its ease of exploitation and high impact.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the password reset API if possible, monitor for suspicious password reset attempts, and consider implementing additional verification steps for password resets such as multi-factor authentication or out-of-band verification.