Medium severity · published Sep 28, 2026
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token Refresh
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall4j · gz-yami
through 4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102367
exploit
https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/T02_refresh_token_enabled_bypass.py
product
https://github.com/gz-yami/mall4j
technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java#L121-L130
technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/controller/TokenController.java#L38-L44
third-party-advisory
https://www.vulncheck.com/advisories/mall4j-through-4.0-insufficient-session-expiration-via-token-refresh
More from mall4j
9.1
CVE-2026-102361
mall4j through 4.0 Missing Authentication in Password Update Endpoint
6.5
CVE-2026-102365
mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
5.4
CVE-2026-108691
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
5.4
CVE-2026-102364
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
5.3
CVE-2026-102362
mall4j through 4.0 Missing Authentication in Product Review Deletion