CVE-2026-108785

6.3 MEDIUMpublic exploit available

Published 2026-10-12 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a
https://github.com/macrozheng/mall/issues/997

All references

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a
https://github.com/macrozheng/mall/issues/997
https://vuldb.com/cve/CVE-2026-108785
https://vuldb.com/submit/959284
https://vuldb.com/vuln/416564
https://vuldb.com/vuln/416564/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-8122
MEDIUMCVE-2025-71435PoC
MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC
MEDIUMCVE-2026-100624PoC
HIGHCVE-2026-100711PoC
UNSCOREDCVE-2026-101271
MEDIUMCVE-2026-102367PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.