CVE-2026-105237 in litemall
Summary
by MITRE • 10/05/2026
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in linlinjava litemall versions up to 1.8.0 represents a critical security flaw within the administrative authentication subsystem, specifically located in the AdminAuthController.java file responsible for handling login requests. This component serves as the primary entry point for administrators to authenticate and gain access to the management interface of the e-commerce platform. The core technical deficiency lies in the absence of effective rate limiting or account lockout mechanisms designed to restrict excessive authentication attempts. In a secure implementation, such controls are essential to prevent automated tools from performing brute-force attacks against user credentials. Without these restrictions, an attacker can submit an unlimited number of login requests with varying username and password combinations until valid credentials are discovered. This lack of restriction fundamentally undermines the integrity of the authentication process, allowing malicious actors to bypass security measures through persistent guessing efforts rather than exploiting a complex code logic error or memory corruption issue.
From an operational perspective, this vulnerability exposes the administrative interface to credential stuffing and brute-force attacks that can be executed remotely over standard network connections. The complexity level is assessed as high because successful exploitation requires sustained interaction with the target system and potentially sophisticated tools capable of rotating IP addresses or handling CAPTCHAs if present, although the description notes exploitability is difficult due to this complexity. However, despite the difficulty in execution, the impact of a successful attack is severe. Compromise of administrative credentials grants full control over the litemall instance, enabling attackers to manipulate product data, access customer personal information including payment details and addresses, alter order statuses for financial fraud, or install persistent backdoors within the application infrastructure. The fact that an exploit is publicly available significantly lowers the barrier to entry for opportunistic attackers who may not possess advanced technical skills but can leverage existing proof-of-concept code to target vulnerable instances across the internet.
This vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, which categorizes flaws where a system fails to limit the number of login attempts or other authentication-related actions within a given time frame. It also relates closely to CWE-287 Improper Authentication, as the failure to enforce limits allows unauthorized entities to authenticate successfully through persistent effort rather than legitimate credential possession. In terms of threat modeling and adversary behavior, this flaw facilitates techniques described in the MITRE ATT&CK framework under Initial Access tactics, specifically Brute Force (T1110) or Credential Stuffing (T1110.004). Attackers utilize these methods to gain initial footholds in environments where weak passwords are common and protective controls like multi-factor authentication or account lockout policies are not enforced at the application level.
The project maintainers were notified of this issue through an official report but have yet to respond, leaving users of litemall versions up to 1.8.0 exposed to risk without a patched version available from the vendor. In the interim, mitigation strategies must be implemented externally since relying on upstream fixes is not viable at this time. Organizations should deploy Web Application Firewalls configured with rules that detect and block rapid successive login failures from single IP addresses or user agents. Additionally, implementing CAPTCHA challenges after a small number of failed attempts can effectively disrupt automated brute-force tools without significantly impacting legitimate users. Enforcing strong password policies and requiring multi-factor authentication for administrative accounts adds a critical layer of defense that renders stolen credentials useless even if the brute-force attack succeeds in guessing them. Regular auditing of login logs to identify anomalous patterns is also recommended to detect ongoing exploitation attempts early.