CVE-2026-102367
Received Received - Intake

Insufficient Session Expiration in mall4j

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102367
EUVD
EUVD-2026-88583

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mall4j mall4j From 3.0 (inc) to 4.0 (inc)
guangzhou_blue_ocean_innovation_technology_co_ltd mall4j to 4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

mall4j through version 4.0 has an insufficient session expiration vulnerability. The POST /token/refresh endpoint fails to validate whether a user account is disabled when issuing new session tokens. This allows disabled accounts to indefinitely renew their sessions, bypassing intended access revocation.

Detection Guidance

To detect this vulnerability, monitor POST requests to /token/refresh endpoints in mall4j systems. Check if disabled user accounts can successfully refresh tokens. Review logs for repeated refresh attempts from the same account after disabling. Use network monitoring tools to inspect token refresh traffic for anomalies.

Impact Analysis

Attackers could exploit this to maintain unauthorized access to disabled accounts for extended periods. Since refresh tokens are set to the same value as access tokens and the endpoint is accessible anonymously, attackers can refresh tokens without separate credentials, retaining system access even after account disabling.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of user access upon account disabling. It undermines data protection principles by allowing unauthorized access persistence, potentially leading to data breaches or unauthorized modifications.

Mitigation Strategies

Immediately update mall4j to a patched version beyond 4.0. If unavailable, implement server-side validation in TokenStore.java and TokenController.java to check the enabled flag during token refresh. Disable anonymous access to /token/refresh and enforce strict user status checks before issuing new tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart