What’s Vulnerable › Vulnerabilities

CVE-2026-108785: macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-613

Description

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

Affected products

• macrozheng mall: 1.0.0, 1.0.1, 1.0.2, 1.0.3

References

• https://github.com/macrozheng/mall/
• https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a
• https://github.com/macrozheng/mall/issues/997
• https://vuldb.com/cve/CVE-2026-108785
• https://vuldb.com/submit/959284
• https://vuldb.com/vuln/416564
• https://vuldb.com/vuln/416564/cti

Get alerted when CVE-2026-108785 or the next vulnerability affects your stack