CVE-2026-25858
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In macrozheng mall version 1.0.3 and prior, there is an authentication vulnerability in the mall-portal password reset workflow. An unauthenticated attacker can reset any user's password using only the victim's telephone number. The one-time password (OTP) is exposed in the API response, and the reset request is validated solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number.
Risk Assessment
The risk is that an attacker can take over any user account with a known or guessable telephone number, leading to unauthorized data access, identity theft, or further attacks on the infrastructure.
Recommendation
Immediately upgrade macrozheng mall to a version newer than 1.0.3 where the vulnerability is patched. As a temporary workaround, disable the telephone-based password reset feature or implement additional identity verification.
Original NVD description (English source)
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.