What’s Vulnerable › Vulnerabilities

CVE-2026-25858: macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-07 · updated 2026-07-14
• Weakness: CWE-640

Description

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.

Affected products

• macrozheng mall: through 1.0.3

References

• https://github.com/macrozheng/mall/issues/946
• https://www.macrozheng.com/
• https://www.vulncheck.com/advisories/macrozheng-mall-unauthenticated-password-reset-via-otp-disclosure

Get alerted when CVE-2026-25858 or the next vulnerability affects your stack