CVE-2026-108785

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-613

Impact

Authenticated remote users can exploit improper session expiration handling to disrupt or manipulate tokens. An attacker requires valid credentials to access the refresh token endpoint.

Root cause

Improper token validation and session expiration handling in the JwtTokenUtil.refreshHeadToken method.

Affected systems

macrozheng mall up to and including 1.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Apply commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a to the codebase or upgrade beyond version 1.0.3. If patching immediately is not possible, restrict access to the /admin/refreshToken endpoint.

shell

$ git cherry-pick 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108785