# CVE-2026-25858: macrozheng mall authentication bypass in password reset workflow

Source: https://junglewise.ai/threats/cve-2026-25858-macrozheng-mall-authentication-bypass-in-password-reset-workflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-07. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-25858 · Severity: critical · CVSS 9.1 · Published 2026-02-07

A security flaw in the macrozheng mall e-commerce platform allows anyone to take over user accounts if they know the user's phone number. The system's password reset process accidentally reveals the secret security code (OTP) in the background web traffic, which an attacker can use to change a victim's password. This could lead to unauthorized access to customer accounts, personal data theft, and disruption of store operations.

Technologies: [Macrozheng Mall](https://junglewise.ai/threats/technologies/mall). Vendors: [Macrozheng](https://junglewise.ai/threats/vendors/macrozheng).

## Quick answers

**Is CVE-2026-25858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25858 being exploited in the wild.

**How severe is CVE-2026-25858?** Critical severity, with a CVSS score of 9.1, published 7 February 2026.

**Which products and versions are affected?** Macrozheng Mall <= 1.0.3.

**Is there a fix for CVE-2026-25858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25858 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25858?** Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in the mall-portal component of macrozheng mall due to a weak password recovery mechanism (CWE-640). The password reset workflow leaks the generated One-Time Password (OTP) directly within the API response to the client. Furthermore, the application validates reset requests by comparing the provided OTP against a value indexed only by the telephone number, without verifying the requester's identity or session. A remote, unauthenticated attacker can exploit this by requesting a reset for a known phone number, capturing the leaked OTP from the response, and successfully resetting the account password to gain full control.

## Affected products

- macrozheng mall <= 1.0.3

## Timeline

- 2026-02-07: advisory: Initial advisory published by VulnCheck
- 2026-02-07: disclosed: CVE-2026-25858 assigned

## References

- [https://github.com/macrozheng/mall/issues/946](https://github.com/macrozheng/mall/issues/946)
- [https://www.macrozheng.com/](https://www.macrozheng.com/)
- [https://www.vulncheck.com/advisories/macrozheng-mall-unauthenticated-password-reset-via-otp-disclosure](https://www.vulncheck.com/advisories/macrozheng-mall-unauthenticated-password-reset-via-otp-disclosure)

## Related threats

- [macrozheng mall business logic error in order generation](https://junglewise.ai/threats/cve-2026-109406-a-weakness-has-been-identified-in-macrozheng-mall-up-to-1-0-3)
- [macrozheng mall authentication bypass in JWT token refresh](https://junglewise.ai/threats/cve-2026-108785-a-flaw-has-been-found-in-macrozheng-mall-up-to-1-0-3-this-issue)
- [macrozheng mall payment business logic error in Alipay](https://junglewise.ai/threats/cve-2026-108784-a-vulnerability-was-detected-in-macrozheng-mall-up-to-1-0-3-this)
- [macrozheng mall authorization bypass in payment status endpoint](https://junglewise.ai/threats/cve-2026-82423-macrozheng-mall-authorization-bypass-in-payment-status-endpoint)
- [macrozheng mall race condition in order submission](https://junglewise.ai/threats/cve-2026-82364-macrozheng-mall-race-condition-in-order-submission)