CVE-2024-11619: macrozheng mall JWT Token default key

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-22 · updated 2026-06-17
Weakness: CWE-1394

Description

A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.

Affected products

macrozheng mall: through 1.0.3

References

https://github.com/macrozheng/mall/issues/880
https://vuldb.com/?ctiid.285842
https://vuldb.com/?id.285842
https://vuldb.com/?submit.444666

Get alerted when CVE-2024-11619 or the next vulnerability affects your stack