CVE-2026-102367

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1

Description An insufficient session expiration issue exists in the token refresh mechanism. The system fails to validate the enabled flag when issuing new sessions, allowing disabled user accounts to indefinitely renew their sessions via the 'POST /token/refresh' endpoint. This allows users to retain access to the system even after their accounts have been disabled.

Recommendations Update mall4j to a version later than 4.0. As a temporary workaround, restrict access to the 'POST /token/refresh' endpoint for accounts that have been marked as disabled.