# CVE-2026-108785: macrozheng mall authentication bypass in JWT token refresh

Source: https://junglewise.ai/threats/cve-2026-108785-a-flaw-has-been-found-in-macrozheng-mall-up-to-1-0-3-this-issue  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108785 · Severity: medium · CVSS 6.3 · Published 2026-10-12

macrozheng mall is an e-commerce system that provides both storefront and admin backends. An attacker can bypass JWT token validation by manipulating the token parameter in the refresh endpoint, potentially maintaining access to disabled user accounts. This allows an attacker to continue operating with an account even after it has been disabled or revoked.

Technologies: [Macrozheng Mall](https://junglewise.ai/threats/technologies/mall). Vendors: [Macrozheng](https://junglewise.ai/threats/vendors/macrozheng).

## Quick answers

**Is CVE-2026-108785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108785 being exploited in the wild.

**How severe is CVE-2026-108785?** Medium severity, with a CVSS score of 6.3, published 12 October 2026.

**Which products and versions are affected?** Macrozheng Mall up to 1.0.3.

**Is there a fix for CVE-2026-108785?** Yes: fixed in A patch is available at commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108785 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108785?** Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in A patch is available at commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a

## Technical details

The vulnerability exists in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, accessible via the /admin/refreshToken endpoint. By manipulating the token argument, an attacker can bypass session expiration checks, allowing disabled tokens or revoked sessions to remain valid. The flaw affects token refresh logic and requires network access but no prior authentication.

## Affected products

- macrozheng mall up to 1.0.3

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/macrozheng/mall/](https://github.com/macrozheng/mall/)
- [https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a](https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a)

## Related threats

- [macrozheng mall business logic error in order generation](https://junglewise.ai/threats/cve-2026-109406-a-weakness-has-been-identified-in-macrozheng-mall-up-to-1-0-3)
- [macrozheng mall payment business logic error in Alipay](https://junglewise.ai/threats/cve-2026-108784-a-vulnerability-was-detected-in-macrozheng-mall-up-to-1-0-3-this)
- [macrozheng mall authorization bypass in payment status endpoint](https://junglewise.ai/threats/cve-2026-82423-macrozheng-mall-authorization-bypass-in-payment-status-endpoint)
- [macrozheng mall race condition in order submission](https://junglewise.ai/threats/cve-2026-82364-macrozheng-mall-race-condition-in-order-submission)
- [macrozheng mall business logic error in cart quantity update](https://junglewise.ai/threats/cve-2026-79406-macrozheng-mall-business-logic-error-in-cart-quantity-update)