External risk intelligence

mall4j Missing Authentication Allows Any Password Reset

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-102361

The vulnerable endpoint resides in a web application designed as an online storefront. Such platforms are typically deployed as public-facing web services to allow customer access, making the account management and password update endpoints reachable over the internet in standard configurations.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in mall4j, an e-commerce platform technology, that allows unauthorized users to reset any account password without authentication. This could lead to account takeovers, potentially exposing customer orders and personal data.

Unauthenticated attackers can reset any storefront password.
Account takeover risks include exposed orders and data.
Confirm relevance to confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target any user's account by sending a request to a specific web endpoint without needing to log in. By simply providing the username of the intended victim, an attacker can change their password, gaining full control over the account. This allows them to access sensitive information like order history and personal details.

No login required to attempt attack.
Target specific user's account.
Account takeover and data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to reset any user's password on the storefront by submitting a username to the password update endpoint. This could lead to unauthorized access to user accounts, including their orders and personal data.

Storefront user accounts and associated data.
Via an unauthenticated network request.
Account takeover and access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in mall4j's password reset endpoint likely impacts application owners responsible for storefront functionality and potentially platform teams if it's part of a managed service. The first critical step is to identify all instances of mall4j, determine their internet-facing exposure and business criticality, and then assign an accountable owner for remediation.

Identify application owners and affected instances.
Verify external reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mall4j?

mall4j is an e-commerce platform designed to support online shopping operations. It provides the backend infrastructure necessary for managing digital storefronts, including user account handling, customer order processing, and personal data storage for retail services.

What does CWE-306 mean for CVE-2026-102361?

CWE-306 is the weakness classification for a missing authentication vulnerability. In the context of this CVE, it means the software fails to verify the identity of a user before performing a sensitive action—specifically, updating a password. Because the system omits this critical security check, it incorrectly assumes the person requesting the password change has the authorization to do so.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by sending a specific network request to the application's password update endpoint. By inputting a target user's account name into the request body, the attacker forces the system to overwrite the existing password. This action does not require the attacker to possess the current password, nor does it require them to be logged into the account they are targeting.

Is my mall4j instance at risk?

According to Halo Surface Signal, this software is typically deployed as a public-facing web service to facilitate customer access. If your instance is reachable over the internet, the endpoint used for account management is likely exposed. You should prioritize checking if your deployment is accessible to external traffic, as this significantly increases the risk profile of this vulnerability.

How should I respond to this advisory?

Begin by identifying every instance of mall4j running in your environment to understand your total footprint. Once located, verify which systems are internet-facing and determine the business criticality of those specific storefronts. Assign clear ownership to those systems so that your team can prepare and implement the necessary security updates once they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.