# CVE-2026-105571: PickMall Lilishop account takeover via mobile binding bypass

Source: https://junglewise.ai/threats/cve-2026-105571-a-flaw-has-been-found-in-pickmall-lilishop-up-to-4-2-4-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105571 · Severity: high · CVSS 7.3 · Published 2026-10-06

PickMall Lilishop is an e-commerce platform with buyer account management features. An unauthenticated attacker can rebind any user's mobile phone number without authorization and then log in as that user by exploiting a hard-coded SMS verification bypass, resulting in complete account takeover.

Technologies: [PickMall Lilishop](https://junglewise.ai/threats/technologies/lilishop). Vendors: [PickMall](https://junglewise.ai/threats/vendors/pickmall).

## Quick answers

**Is CVE-2026-105571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105571 being exploited in the wild.

**How severe is CVE-2026-105571?** High severity, with a CVSS score of 7.3, published 6 October 2026.

**Which products and versions are affected?** PickMall Lilishop up to 4.2.4.

**Is there a fix for CVE-2026-105571?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105571 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105571?** Check whether you run PickMall Lilishop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization flaw in the /buyer/passport/member/bindMobile endpoint allows unauthenticated users to rebind any member's mobile phone by supplying the target username and a new phone number; the SMS code verification accepts the literal string "0" as valid for any number. An attacker can then use the same SMS bypass in /buyer/passport/member/smsLogin to obtain an authentication token for the victim's account.

## Affected products

- PickMall Lilishop up to 4.2.4

## Timeline

- 2026-09-16: disclosed: Issue reported on GitHub
- 2026-10-06: advisory: CVE-2026-105571 published

## References

- [https://github.com/lilishop/lilishop/issues/148](https://github.com/lilishop/lilishop/issues/148)
- [https://vuldb.com/cve/CVE-2026-105571](https://vuldb.com/cve/CVE-2026-105571)

## Related threats

- [PickMall lilishop insecure direct object reference in receipt endpoint](https://junglewise.ai/threats/cve-2026-111647-pickmall-lilishop-through-5-0-0-contains-an-insecure-direct)
- [PickMall lilishop insecure direct object reference in freight template](https://junglewise.ai/threats/cve-2026-110122-pickmall-lilishop-through-4-4-contains-an-insecure-direct-object)
- [PickMall lilishop insecure direct object reference in product update](https://junglewise.ai/threats/cve-2026-110121-pickmall-lilishop-through-4-4-contains-an-insecure-direct-object)
- [PickMall Lilishop authorization bypass in buyer invoice list](https://junglewise.ai/threats/cve-2026-105572-a-vulnerability-has-been-found-in-pickmall-lilishop-up-to-4-2-4)