CVE-2026-103539 in SuperMarket
Summary
by MITRE • 10/01/2026
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in ZongXR SuperMarket version 1.0.0.0 represents a critical authentication bypass flaw located within the Instant Buy module, specifically affecting the startBuy function implemented in the Java class instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java. This security defect arises from improper validation or handling of the Username argument passed to this endpoint. When an attacker manipulates this input parameter, they can circumvent standard authentication mechanisms required for executing purchase transactions. The root cause typically involves a failure to properly bind user identity context with session management or token verification logic during the transaction initiation phase, allowing unauthenticated users to impersonate legitimate accounts or bypass access controls entirely.
From a technical perspective, this flaw aligns closely with CWE-287, which describes Improper Authentication, and more specifically CWE-306, Missing Authentication for Critical Function. The vulnerability allows remote attackers to perform unauthorized actions by exploiting the lack of rigorous checks on user identity before processing sensitive business logic. Since the startBuy function is responsible for initiating financial transactions or inventory reservations, bypassing authentication effectively grants an attacker full control over a user's purchasing capabilities without valid credentials. This type of flaw often stems from developers assuming that certain endpoints are protected by higher-level filters while neglecting to enforce security checks at the method level itself, creating a gap in defense-in-depth strategies.
The operational impact of this vulnerability is severe due to its remote exploitability and public availability. Attackers can leverage publicly available exploits to conduct unauthorized purchases, potentially leading to financial fraud, inventory depletion, or data integrity issues within the e-commerce platform. Because the project maintainers have not yet responded to early issue reports, there is currently no official patch or mitigation provided by the vendor. This lack of response leaves deployed instances highly susceptible to automated scanning tools and targeted attacks that seek to exploit known weaknesses in widely used frameworks like Spring Boot, which this application likely utilizes given its Java-based architecture.
To mitigate these risks in the absence of an immediate vendor update, organizations running ZongXR SuperMarket should implement compensating controls at the network or infrastructure level. Web Application Firewalls can be configured with rules to detect and block anomalous requests targeting the InstantBuyController endpoints, particularly those exhibiting patterns consistent with authentication bypass attempts such as missing session tokens or malformed username parameters. Additionally, strict input validation must be enforced on all user-supplied data before it reaches business logic layers. Developers should review the startBuy method to ensure that security annotations like @PreAuthorize are correctly applied and that Spring Security configurations explicitly require authenticated users for this specific action rather than relying on implicit assumptions about endpoint protection.