提交 #990053: gz-yami mall4j f19b355fe50485b8c41507e6e646fa431fe064a8 Improper Authentication

gz-yami mall4j contains an improper authentication vulnerability in the member password-update functionality. The PUT /user/updatePwd endpoint is reachable without authentication and allows a remote caller to identify a target member solely through the client-supplied nickName value. The endpoint overwrites the target member's password without requiring a valid access token, the current password, or a verification code. Although the submitted password is AES-encrypted, the default auth.password.signKey is distributed with the application and embedded in the web clients, so possession of the encryption key does not provide an effective authentication barrier. As a result, an unauthenticated remote attacker who knows a member nickname can replace that member's password and subsequently authenticate as the victim. The issue was reproduced at commit f19b355fe50485b8c41507e6e646fa431fe064a8, where an anonymous password update succeeded and the attacker was subsequently able to log in as the victim while the original password no longer worked.

The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date.

• 用户: cztang (UID 101252)
• 提交: 2026-09-18 07時58分 (18 日前)
• 管理: 2026-10-05 18時36分 (17 days later)
• 状态: 重复
• VulDB条目: 411222 [gz-yami mall4j 直到 4.0 Password Reset /user/updatePwd username 弱身份验证]
• 积分: 0