Is CVE-2026-108785 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108785 being exploited in the wild.

How severe is CVE-2026-108785?

Medium severity, with a CVSS score of 6.3, published 12 October 2026.

Is there a fix for CVE-2026-108785?

Yes: fixed in A patch is available at commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108785 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108785?

Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108785: macrozheng mall authentication bypass in JWT token refresh

CVE-2026-108785 · Severity: medium · CVSS 6.3 · Published 2026-10-12

macrozheng mall is an e-commerce system that provides both storefront and admin backends. An attacker can bypass JWT token validation by manipulating the token parameter in the refresh endpoint, potentially maintaining access to disabled user accounts. This allows an attacker to continue operating with an account even after it has been disabled or revoked.

Technologies: Macrozheng Mall. Vendors: Macrozheng.

Quick answers

Is CVE-2026-108785 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108785 being exploited in the wild.
How severe is CVE-2026-108785?: Medium severity, with a CVSS score of 6.3, published 12 October 2026.
Which products and versions are affected?: Macrozheng Mall up to 1.0.3.
Is there a fix for CVE-2026-108785?: Yes: fixed in A patch is available at commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108785 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108785?: Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: A patch is available at commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a

Technical details

The vulnerability exists in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, accessible via the /admin/refreshToken endpoint. By manipulating the token argument, an attacker can bypass session expiration checks, allowing disabled tokens or revoked sessions to remain valid. The flaw affects token refresh logic and requires network access but no prior authentication.

Affected products

macrozheng mall up to 1.0.3

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.