CVE-2026-19361
Received Received - Intake

Weak Password Recovery in MacroZheng Mall

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19361
EUVD
EUVD-2026-54932

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
macrozheng mall *
macrozheng mall From 0504e86 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken authentication flaw in macrozheng mall affecting the /sso/getAuthCode endpoint. It allows attackers to obtain verification codes without proper authentication, enabling them to reset account passwords and take over member accounts remotely.

Detection Guidance

Check if the /sso/getAuthCode endpoint returns verification codes directly in responses without authentication. Test if /sso/updatePassword allows password resets with only a phone number and verification code. Verify if these endpoints are publicly accessible by inspecting security configurations for /sso/** whitelisting.

Impact Analysis

An attacker could exploit this to gain full access to your account, allowing them to view sensitive data like personal information, orders, and addresses. They can reset your password using only your phone number and a verification code obtained from the vulnerable endpoint.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It could lead to unauthorized access to personal data, breaching GDPR and HIPAA regulations which mandate strict controls over sensitive information.

Mitigation Strategies

Disable direct verification code exposure in /sso/getAuthCode responses. Require authentication for /sso/updatePassword and /sso/getAuthCode endpoints. Implement rate limiting and logging for these endpoints. Remove /sso/** from public access whitelists. Force password resets for all users and review account logs for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart