The issue lies in the token refresh logic of the mall authentication filter, where an attacker can manipulate the token passed to the refresh endpoint and force a session expiration. This flaw leverages improper validation of token arguments, resulting in unintended termination of user sessions. Because the vulnerability allows remote exploitation, a malicious user could trigger accidental logout or degrade availability for legitimate users.

The affected product is the macrozheng mall application. Versions up to 1.0.3 are impacted; the patch commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a addresses the problem.

The CVSS score of 5.3 indicates a medium severity risk. EPSS data is not available, so exact exploitation probability cannot be quantified, but the vulnerability is listed as having a published exploit and is controllable remotely via the /admin/refreshToken endpoint. KEV status is not listed, but the presence of an exploit in the public domain suggests that the risk to organizations remains tangible.