Is there a public PoC exploit available for CVE-2026-19361?

Yes, a public proof-of-concept exploit is available for CVE-2026-19361. Prioritise patching immediately. EPSS: 0.3%.

macrozheng mall CVE-2026-19361

Q: What is the CVSS score of CVE-2026-19361?

CVE-2026-19361 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54932 LOW

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-08-09 VulDB

GHSA-4j4g-jhqh-8v4w

Information Disclosure Mall Macrozheng

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network-accessible unauthenticated endpoint with high exploitation complexity; only limited integrity impact via account password reset, no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 09, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

Aug 09, 2026 - 18:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

Analysis Generated

Aug 09, 2026 - 18:05 vuln.today

CVE Published

Aug 09, 2026 - 17:15 cve.org

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

AnalysisAI

Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal module to remote manipulation, enabling account takeover via a broken authentication flow. The flaw maps to CWE-640 and requires no authentication, though exploitation is rated high complexity. A publicly available exploit has been published; the vendor deleted the corresponding GitHub issue without explanation and has not responded to private disclosure.

Technical ContextAI

macrozheng/mall is an open-source Java-based e-commerce platform hosted on GitHub (CPE: cpe:2.3:a:macrozheng:mall). The vulnerable component is the mall-portal module's /sso/getAuthCode endpoint, which handles auth code generation for the password recovery workflow. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) identifies the root cause: the auth code issued during password reset is either predictable, insufficiently validated, lacks rate-limiting, or can be bypassed - allowing an attacker to hijack the recovery flow. The CVSS 4.0 vector (E:P) confirms a proof-of-concept has been published, as referenced in the exploit repository at github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor deleted the GitHub issue and has not responded to disclosure. Organizations running macrozheng mall should apply compensating controls immediately: restrict access to the /sso/getAuthCode endpoint via WAF rules or network-layer controls to trusted IP ranges, reducing exposure to the remote attack vector. Implement rate-limiting and account-lockout mechanisms on the password recovery endpoint to raise the cost of brute-force code prediction. Replacing the auth code generation logic with a cryptographically secure random token of sufficient entropy (minimum 128 bits) would eliminate the root CWE-640 condition. Operators should monitor the upstream GitHub repository at github.com/macrozheng/mall for any future commits addressing this endpoint. Note that restricting the endpoint affects legitimate password recovery for end users and may require a user-facing fallback process.