CVE-2026-19361: Macrozheng Mall Auth Bypass Vulnerability

CVE-2026-19361 Overview

CVE-2026-19361 is a weak password recovery vulnerability affecting the macrozheng mall e-commerce platform at commit 0504e86. The flaw resides in the /sso/getAuthCode endpoint of the mall-portal module. An attacker can manipulate the authentication code recovery mechanism remotely without authentication. The weakness is categorized under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).

The vendor deleted the GitHub issue tracking this vulnerability without explanation and did not respond to disclosure emails. A public exploit has been released.

Critical Impact
Attackers can abuse the SMS or email authentication code recovery flow to compromise account credentials, potentially leading to unauthorized account access in the mall-portal module.

Affected Products

macrozheng mall e-commerce platform at commit 0504e86
mall-portal module component
/sso/getAuthCode endpoint

Discovery Timeline

2026-08-09 - CVE-2026-19361 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19361

Vulnerability Analysis

The vulnerability affects the single sign-on authentication code generation endpoint /sso/getAuthCode within the macrozheng mall mall-portal module. This endpoint issues verification codes used during password recovery or account authentication workflows. The implementation uses a weak recovery mechanism that fails to adequately protect against enumeration or brute-force guessing of authentication codes.

The attack requires network access and can be executed without prior authentication or user interaction. The exploitability is rated as difficult due to high attack complexity, but a working exploit has been published, elevating operational risk for exposed deployments.

Root Cause

The root cause is an insecure design in the authentication code recovery flow. The /sso/getAuthCode endpoint generates verification codes with insufficient entropy, rate limiting, or binding to the requesting session. This aligns with CWE-640, where the recovery mechanism can be abused to bypass normal authentication controls.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to /sso/getAuthCode targeting a victim's phone number or email account. Because the code generation or validation lacks strong protections, the attacker may enumerate valid codes, replay codes, or otherwise circumvent the intended verification step. Successful exploitation enables account takeover within the mall-portal user context.

No verified code examples are available for this vulnerability. See the GitHub Issue Report and VulDB CVE Report for additional technical detail.

Detection Methods for CVE-2026-19361

Indicators of Compromise

Repeated HTTP requests to the /sso/getAuthCode endpoint from a single source IP address or across rotated proxies.
Elevated volume of authentication code requests targeting the same account identifier, phone number, or email.
Successful account logins immediately following bursts of getAuthCode traffic without corresponding legitimate user activity.

Detection Strategies

Deploy web application firewall rules that flag anomalous request rates to /sso/getAuthCode on any deployment of macrozheng mall.
Correlate authentication code requests with subsequent password reset or login events to identify short-window takeover chains.
Alert on mall-portal access log patterns showing multiple auth code requests followed by successful authentication from a new IP or device fingerprint.

Monitoring Recommendations

Enable verbose logging on the mall-portal SSO module, capturing request source, target account, and code validation outcomes.
Monitor for outbound SMS or email spikes generated by the auth code issuance workflow, which can indicate abuse attempts.
Track account setting changes such as email, phone, or password modifications made shortly after /sso/getAuthCode activity.

How to Mitigate CVE-2026-19361

Immediate Actions Required

Restrict public exposure of the /sso/getAuthCode endpoint using network access controls or reverse proxy authentication where feasible.
Enforce strict rate limiting per source IP and per target account on all authentication code requests.
Audit recent mall-portal account activity for signs of unauthorized access, password changes, or contact information modifications.

Patch Information

At the time of publication, the vendor has not released an official patch. The vendor deleted the associated GitHub issue and did not respond to disclosure attempts. Operators running the affected commit 0504e86 should track the macrozheng mall GitHub repository for future security updates and apply community-developed fixes only after independent code review.

Workarounds

Implement application-layer rate limiting and CAPTCHA challenges on the /sso/getAuthCode endpoint until an official patch is available.
Increase authentication code entropy and shorten code validity windows within the mall-portal module through custom code changes.
Bind issued authentication codes to the originating session or device fingerprint to prevent cross-session replay.
Require an additional verification factor before permitting password resets or sensitive account changes.

bash

# Example nginx rate limit configuration for the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=authcode:10m rate=3r/m;

location /sso/getAuthCode {
    limit_req zone=authcode burst=5 nodelay;
    proxy_pass http://mall-portal-backend;
}