CVE-2026-102367 in mall4j
Summary
by MITRE • 09/29/2026
mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability resides within mall4j versions up to 4.0 and specifically targets the token refresh mechanism used for maintaining authenticated state in web applications. This flaw represents a critical failure in session management logic where the application fails to perform adequate authorization checks before issuing new access tokens or refreshing existing sessions. The core technical deficiency lies in the POST /token/refresh endpoint, which is designed to extend the validity of user sessions by generating new authentication credentials based on provided refresh tokens. However, the implementation neglects to verify whether the underlying user account associated with these tokens has been disabled or deactivated within the system's database. This oversight allows any entity possessing a valid refresh token for an inactive user to continuously request and receive new access tokens, effectively bypassing the intended security control that should have revoked their ability to interact with the application upon account disablement.
From a technical perspective, this vulnerability is classified under CWE-613, which denotes Insufficient Session Expiration, although it also intersects significantly with CWE-287 regarding Improper Authentication and CWE-640 on Weak Password Recovery Mechanism for Accounts if such mechanisms are involved in the token lifecycle. The flaw exploits the assumption that a refresh token remains valid solely based on its cryptographic integrity and expiration time, ignoring the dynamic status of the user account it represents. In standard secure implementations, every step involving authentication state changes must query the current authorization state of the principal to ensure compliance with administrative policies. By omitting this check, mall4j creates a persistent backdoor for previously authenticated users who have been explicitly denied access by administrators or system rules.
The operational impact of this vulnerability is severe, as it allows disabled user accounts to retain indefinite access to protected resources and sensitive data within the mall4j ecosystem. An attacker with knowledge of valid refresh tokens belonging to deactivated accounts can maintain a persistent foothold in the application environment. This persistence undermines the principle of least privilege and compromises the integrity of administrative controls designed to revoke access immediately upon account suspension, such as after an employee departure or security incident response. The ability to indefinitely renew sessions means that traditional session timeout mechanisms are rendered ineffective for these specific accounts, leading to potential data breaches, unauthorized transactions, and compliance violations related to access control standards like ISO 27001 and NIST SP 800-53 AC-2 which mandate timely revocation of access privileges.
To mitigate this vulnerability, developers must modify the token refresh logic in mall4j to include a mandatory validation step that queries the user's current status before issuing new tokens. This check should verify against the central identity store or database to ensure the enabled flag is true for the account associated with the presented refresh token. If the account is found to be disabled, the system must immediately invalidate the request and return an appropriate error code indicating unauthorized access rather than generating a new session. Additionally, implementing short-lived access tokens combined with robust server-side session invalidation lists can further reduce the window of opportunity for exploitation. Organizations should also consider adopting industry-standard frameworks that enforce strict state management protocols aligned with OWASP guidelines to prevent similar logic flaws in authentication flows.