linlinjava litemall CVE-2026-105237

The specific prerequisite is that the litemall admin-api login endpoint (AdminAuthController) enforces no lockout, throttling, CAPTCHA, or limit on failed authentication attempts, allowing unlimited credential-guessing. Exploitation is strongly LIMITED by: high attack complexity (VulDB rates it 'difficult'); dependence on weak, default, or guessable admin credentials since the flaw only removes the brute-force barrier rather than bypassing authentication; and requires the admin-api component to be deployed and network-reachable. Impact is confined to low confidentiality with no integrity or availability effect.

This is a genuinely low-priority issue despite being publicly documented. The CVSS 4.0 score of 2.9 (Low) is consistent across signals: the vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated weakness but with HIGH attack complexity, and VulDB explicitly notes exploitability is 'difficult.' The flaw (CWE-307, missing restriction on excessive authentication attempts) has no direct impact of its own - it only enables brute-forcing, reflected in the low single confidentiality impact (VC:L) and zero integrity/availability impact. POC status is YES (the exploit is public per VulDB), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of real-world exploitation - publicly available exploit code exists but must not be conflated with active exploitation. A notable nuance: the realized risk is almost entirely conditional on weak or guessable admin credentials, since the AC:H rating reflects that brute-forcing a strong password remains impractical even without rate limiting. Net: a real but minor hardening gap, not an urgent threat.

An attacker reaches the litemall admin login endpoint (AdminAuthController) over the network and runs an automated password-guessing tool, which the application fails to rate-limit or lock out. Over many attempts they attempt to recover a weak or default admin credential and gain administrative access. Public exploit/POC material exists (VulDB), though the high attack complexity means success hinges on weak credentials.