CVE-2026-105237: linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of linlinjava litemall up to version 1.8.0 may be affected if their Login Endpoint is reachable remotely. The affected code is identified as AdminAuthController.java in the litemall-admin-api component.
What does an attacker need to exploit it?
The attack can be performed remotely without stated authentication or user interaction requirements. Exploitation is described as high complexity and difficult, although a public exploit is available.
Are there any mitigation details available if patching is not immediately possible?
No workaround or mitigation is provided in the available data. The project was reportedly notified through an issue report but had not responded at the time of publication.