CVE-2026-25858

The password reset flow in the mall-portal component returns a one-time OTP code directly in the API response, disclosing it to the attacker. Verification of the password reset request is based solely on comparing the supplied OTP code with the value stored on the server associated with the phone number. The application does not verify the identity of the requester or actual ownership of the provided phone number. An attacker can therefore initiate a password reset for a victim, read the OTP from the API response, and set a new password for any account.

An attacker remotely takes full control of any user account for which they know or can guess the phone number. This results in unauthorized account access and loss of confidentiality and integrity of the victim's account data.

Patches available from the vendor should be applied according to the references. Temporarily, it is recommended to disable the password reset feature via phone number or implement a server-side phone number ownership verification mechanism (e.g., sending OTP only via SMS without including it in the API response) and introduce user identity validation in the password reset process.

Macrozheng Mall version 1.0.3 and earlier (mall-portal component).