CVE-2026-108785

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108785

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108785.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108785

Published

2026-10-12T01:15:20Z

Modified

2026-10-14T07:03:45Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

Details

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108785.json"
}

References

Affected packages

Git / github.com/macrozheng/mall

Affected ranges

Type

GIT

Repo

https://github.com/macrozheng/mall

Events

Introduced

470c40eb1656485e53fa175afd7c05d506b42e02

Fixed

9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "introduced":  "1.0.1"
        },
        {
            "last_affected":  "1.0.1"
        },
        {
            "introduced":  "1.0.2"
        },
        {
            "last_affected":  "1.0.2"
        },
        {
            "introduced":  "1.0.3"
        },
        {
            "last_affected":  "1.0.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108785.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "225625236891890548552812726538503455709",
                "295362927377494469004546511985918393314",
                "36410619557056110698643647044892752810",
                "81249224538841364678196189607066184092"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108785-21874ec9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a",
        "target":  {
            "file":  "mall-security/src/main/java/com/macro/mall/security/util/JwtTokenUtil.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "148241641028324738569900444944362563176",
            "length":  169
        },
        "id":  "CVE-2026-108785-74cde6ca",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a",
        "target":  {
            "file":  "mall-security/src/main/java/com/macro/mall/security/util/JwtTokenUtil.java",
            "function":  "validateToken"
        }
    }
]

vanir_signatures_modified

"2026-10-14T07:03:45Z"