macrozheng mall versions 1.0.3 and earlier contain an authentication flaw in the password reset workflow that exposes one-time passwords in the API response and only verifies the OTP against the telephone number. Because the system does not confirm that the requester owns the phone or that the phone belongs to the target account, an attacker who knows or guesses a user’s phone number can reset that user’s password without any authentication. The vulnerability allows immediate account takeover and full access to the compromised account’s data and privileges.

All installations of macrozheng mall up to and including version 1.0.3 are affected. The product is also referenced in the newbee-mall_project collection, suggesting that similar builds with the same password reset flow are vulnerable. The explicit affected versions are not listed beyond the version ceiling of 1.0.3, so any derivative or legacy deployment should be reviewed for the same implementation.

The high CVSS score of 9.3 reflects a severe exploitation likelihood, and the EPSS score of less than 1% indicates that while exploitation is theoretically possible, it is currently infrequent. The vulnerability is not listed in the CISA KEV catalog. The attack path requires only the ability to target the password reset API and provide a known or guessable telephone number, making it trivial for an unauthenticated attacker to launch a successful account takeover. The lack of any additional verification step further lowers the barrier to exploitation.