CVE-2026-19361
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code in /sso/getAuthCode of the mall-portal module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue without explanation and did not respond to email contact.
Risk Assessment
An attacker can remotely, with high complexity, exploit weak password recovery, potentially leading to unauthorized access to user accounts.
Recommendation
Apply vendor patches if available. Restrict access to /sso/getAuthCode and strengthen password recovery mechanisms.
Original NVD description (English source)
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.