---
id: CVE-2026-108785
title: A flaw has been found in macrozheng mall up to 1.0.3
summary: >-
  A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the
  function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the
  component JwtAuthenticationTokenFilter. This manipulation of the argument
  token ca…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-613
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T02:16:56.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108785'
references:
  - url: 'https://github.com/macrozheng/mall/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a
    label: cna@vuldb.com
  - url: 'https://github.com/macrozheng/mall/issues/997'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108785'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/959284'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416564'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416564/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.074Z'
---

## Overview

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.