MacroZheng Mall EUVD-2026-97139

Requires the attacker to already possess a valid low-privilege JWT for the macrozheng mall application (PR:L) - it is NOT exploitable by fully unauthenticated attackers. The concrete weakness is that pre-patch JwtTokenUtil.validateToken checked only username match and token non-expiry, omitting userDetails.isEnabled(); therefore a token belonging to a disabled/deactivated account still validated and could be refreshed via the refreshToken flow, prolonging a session that should have been terminated. Limiting factors: valid authenticated token needed, impact confined to session longevity/retained access (no scope change, low C/I/A), and the affected code path is the JWT refresh/validation logic of mall ≤1.0.3.

This is a medium-severity, low-urgency issue. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 5.3) indicates a network-reachable, low-complexity flaw but explicitly requires low-level privileges (PR:L) - the attacker must already hold a valid application token, which sharply limits mass exploitation. Impact is uniformly low (VC:L/VI:L/VA:L) and there is no scope change, consistent with CWE-613 (Insufficient Session Expiration): the pre-patch validateToken() failed to check userDetails.isEnabled(), so a disabled/deactivated account's token still validated and could be refreshed. A public exploit exists (GitHub issue #997) and the E:P (Proof-of-Concept) exploit-maturity flag matches that, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. Net: a legitimate but modest-priority defect - authenticated-only, low-impact session-lifecycle weakness rather than a high-real-risk remote takeover. EPSS/KEV signals are absent and should be checked before deprioritizing entirely.

An attacker who already holds a valid low-privilege JWT (e.g. an account that was subsequently disabled by an administrator) calls the token-refresh endpoint; because validateToken did not verify the account was still enabled, the token is accepted and the session persists beyond when it should have expired. A proof-of-concept is publicly published in GitHub issue #997, and the network vector with low attack complexity makes the request trivial to reproduce.