{"id":"CVE-2026-108785","title":"A flaw has been found in macrozheng mall up to 1.0.3","summary":"A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token ca…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-613"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T02:16:56.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108785","references":[{"url":"https://github.com/macrozheng/mall/","label":"cna@vuldb.com"},{"url":"https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a","label":"cna@vuldb.com"},{"url":"https://github.com/macrozheng/mall/issues/997","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-108785","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/959284","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/416564","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/416564/cti","label":"cna@vuldb.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T14:50:34.074Z","slug":"CVE-2026-108785","body":"## Overview\n\nA flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}