Is CVE-2026-25858 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25858 being exploited in the wild.

How severe is CVE-2026-25858?

Critical severity, with a CVSS score of 9.1, published 7 February 2026.

Is there a fix for CVE-2026-25858?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-25858 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-25858?

Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25858: macrozheng mall authentication bypass in password reset workflow

CVE-2026-25858 · Severity: critical · CVSS 9.1 · Published 2026-02-07

A security flaw in the macrozheng mall e-commerce platform allows anyone to take over user accounts if they know the user's phone number. The system's password reset process accidentally reveals the secret security code (OTP) in the background web traffic, which an attacker can use to change a victim's password. This could lead to unauthorized access to customer accounts, personal data theft, and disruption of store operations.

Technologies: Macrozheng Mall. Vendors: Macrozheng.

Quick answers

Is CVE-2026-25858 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25858 being exploited in the wild.
How severe is CVE-2026-25858?: Critical severity, with a CVSS score of 9.1, published 7 February 2026.
Which products and versions are affected?: Macrozheng Mall <= 1.0.3.
Is there a fix for CVE-2026-25858?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25858 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-25858?: Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the mall-portal component of macrozheng mall due to a weak password recovery mechanism (CWE-640). The password reset workflow leaks the generated One-Time Password (OTP) directly within the API response to the client. Furthermore, the application validates reset requests by comparing the provided OTP against a value indexed only by the telephone number, without verifying the requester's identity or session. A remote, unauthenticated attacker can exploit this by requesting a reset for a known phone number, capturing the leaked OTP from the response, and successfully resetting the account password to gain full control.

Affected products

macrozheng mall <= 1.0.3

Timeline

2026-02-07: advisory: Initial advisory published by VulnCheck
2026-02-07: disclosed: CVE-2026-25858 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.