Password Reset Vulnerability in Macrozheng Mall by Macrozheng

CVE-2026-25858

What is CVE-2026-25858?

The Macrozheng Mall versions up to 1.0.3 have a serious authentication vulnerability in the password reset process. An attacker can exploit this flaw to reset a user’s password simply by knowing their telephone number. This occurs because the password reset workflow incorrectly exposes the one-time password (OTP) in the API response and does not adequately verify the user’s identity or phone number ownership. Consequently, an unauthorized individual may gain access to any user's account, potentially leading to data breaches and other malicious activities.

References