CVE-2026-25858: Macrozheng Mall Password Reset OTP Exposure Leading to Account Takeover
CVE-2026-25858 affects macrozheng mall version 1.0.3 and prior, where the mall-portal password reset workflow exposes the one-time password in the API response. According to the record, an unauthenticated attacker could use only a victim's telephone number to reset account passwords, and NVD lists it with CVSS 3.1 9.8 while VulnCheck lists 9.1.
Overview
The record describes CVE-2026-25858 in macrozheng mall, affecting version 1.0.3 and prior. The weakness is in the password reset workflow of the mall-portal component and is classified as CWE-640, Weak Password Recovery Mechanism. The NVD record and the VulnCheck advisory are the sources used for this summary.
Impact
- According to the record, an unauthenticated attacker could reset passwords of arbitrary user accounts using only the victim's telephone number.
- The record describes this as remote account takeover for users with a known or guessable telephone number.
- VulnCheck scores the issue 9.1 under CVSS 3.1, with network vector, low complexity, no privileges and no user interaction. The record reports high confidentiality and integrity impact and no availability impact.
Affected products and versions
- Product: Macrozheng Mall.
- Range listed: version 1.0.3 and prior, shown in the record as less than or equal to 1.0.3.
- The record does not state a lower bound for the range or a fixed version.
Exploitation status
- The record lists the CVE as not present in CISA KEV, so it is not presented here as actively exploited in the wild.
- No confirmed exploitation appears in the sources consulted for this analysis.
- EPSS in the record gives a probability of 0.01099 and a percentile of 0.64793.
Remediation and mitigation
- Inventory all macrozheng mall deployments at version 1.0.3 or earlier, including internal, staging and test environments.
- Check the upstream project and its issue tracker for an official fix or update. The record does not identify one.
- Until a verified fix is applied, limit network exposure of the mall-portal interface and restrict access to password reset functions.
- Review whether the reset process depends only on a phone number and a returned code, and add independent identity verification where possible.
- Review accounts that may have been affected, including unexpected password changes and unusual login activity.
Detection guidance
- Review web and API logs for unusual volumes of password reset requests, especially many requests across different phone numbers.
- Alert on password reset events that are not confirmed by the legitimate account owner, and on logins from new locations shortly after a reset.
- Monitor reset responses for sensitive verification data, which a correct implementation should never return to the client.
Limitations of the available information
- The record does not include a vendor advisory, a patched version, or the vendor's response.
- Scores differ across sources: VulnCheck CVSS 3.1 gives 9.1, NVD CVSS 3.1 gives 9.8, and VulnCheck CVSS 4.0 gives 9.3.
- The record does not state whether the vulnerable reset path is enabled by default or how widely it is deployed.
Frequently asked questions
What is the core weakness in CVE-2026-25858?
According to the record, the password reset flow returns the one-time password in the API response and checks requests only against a value stored by telephone number, without verifying the user's identity or phone ownership.
Is there a fixed version available?
The record does not list a fixed version. The status of an official fix is unknown, so administrators should check the upstream project for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.