Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-07 | 1 | General1 |
| 2026-02-08 | 2 | Disclosure1Patch1 |
CVE-2026-25858 macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to… https://www.cve.org/CVERecord?id=CVE-2026-25858
Post summary
The post announces CVE‑2026‑25858 as an authentication vulnerability in macrozheng mall’s password reset process but provides no further technical details, exploit code, or mitigation information.
🚨 CRITICAL flaw in macrozheng mall ≤1.0.3 lets attackers reset any user's password with just a phone number! Patch ASAP or disable reset function. https://radar.offseq.com/threat/cve-2026-25858-cwe-640-weak-password-recovery-mech-3ff06a38 #OffSeq #CVE202625858 #infosec https://t.co/8Tb0TOjStx
Post summary
The tweet alerts that macrozheng mall versions ≤1.0.3 have a critical flaw allowing password resets via phone number alone, urging users to patch or disable the reset feature.
🚨 CRITICAL vuln in macrozheng mall ≤1.0.3: Weak password reset lets attackers take over any account with just a phone number — no auth needed! Disable resets & enforce MFA now. Details: https://radar.offseq.com/threat/cve-2026-25858-cwe-640-weak-password-recovery-mech-3ff06a38... https://t.co/zKYRwSHJHr
Post summary
The tweet announces a critical vulnerability in macrozheng mall (≤1.0.3) that permits account takeover via a weak password reset, and recommends disabling resets and enforcing MFA as a workaround.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | macrozheng | mall | - | - | - |