CVE-2026-108785: macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
macrozheng mallto a version that resolves this vulnerability.Patch 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the affected refresh-token functionality. No user interaction is required.
Is public exploit code available?
Yes. The available data states that an exploit has been published and may be used.
What should be prioritized for remediation?
Deploy patch 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. The affected releases are macrozheng mall up to 1.0.3.