API returns the OTP — now everyone’s account is at risk: macrozheng mall password-reset flaw (CVE-2026-25858) that lets attackers seize customer accounts
What happened (short and sharp)
A new advisory for macrozheng mall (version 1.0.3 and prior) describes a critical authentication weakness in the mall-portal password reset workflow identified as CVE-2026-25858. The password reset flow exposes the one-time password (OTP) directly in an API response and validates resets using only the OTP associated with a telephone number, without verifying ownership of that number. That combination allows an unauthenticated attacker to reset arbitrary user passwords using only a known or guessable telephone number.
The vendor, product and affected versions are stated in the advisory; the vulnerability enables remote account takeover and has been scored as 9.3 (CRITICAL).
Why this matters to your business
If you run an online storefront, customer portal or any service that uses the macrozheng mall package — or if third‑party suppliers do — this is not a theoretical problem. Account takeover means an attacker can impersonate customers, place orders, view or change personal details, commit fraud, or pivot to other systems where reused credentials are present.
Beyond the immediate operational pain, the real headaches are reputational damage, chargebacks or fraudulent transactions, regulatory notification obligations (think data protection authorities), and the loss of customer trust that takes far longer to rebuild than a weekend of emergency patching.
How this typically goes wrong (and how it escalates)
Designing a reset workflow that trusts a single piece of information tied to a phone number is a classic single-point-of-failure. Telephone numbers can be publicly exposed, guessed, or abused via social engineering and SIM‑swap attacks. If your system echoes sensitive tokens in API responses — intentionally or by poor error handling — you have effectively handed attackers the keys on a plate.
Left unaddressed, these account compromises often run quietly for weeks: attackers test card details, commit micro‑fraud, escalate privileges, or use compromised accounts as beachheads for supply‑chain abuse. Meanwhile, incident response time, forensic work and regulatory reporting costs stack up — not to mention the hair‑raising board calls.
Practical controls and quick wins you can do tomorrow
Fixing this properly will need vendor patches and code changes, but there are immediate steps organisations can take to reduce exposure while a patch is applied:
-
Require the vendor or your developers to remove any exposure of OTPs (never return OTPs in API responses or logs).
-
Review and harden the password‑reset flow so it verifies ownership (multi‑channel confirmation, knowledge factors, or out‑of‑band verification), not just possession of a phone number.
-
Enable multi‑factor authentication (MFA) for customer accounts where feasible; treat it as essential for high‑risk actions.
-
Implement rate limiting, anomaly detection and account‑takeover monitoring to spot multiple resets or suspicious flows.
-
Ensure logging and alerting are capturing reset requests and failed attempts, and that logs are monitored centrally.
-
If you rely on third‑party packages, perform an immediate inventory and prioritise updates for exposed versions; if immediate patching is impossible, mitigate by disabling the vulnerable module or restricting access to the affected endpoint.
How recognised standards reduce this risk
An ISO 27001 information security management approach would have flagged weak authentication and exposed secrets as key risks during regular risk assessment and control selection, then driven remediation via documented access‑control and secure‑development requirements.
Supplier and third‑party software management — a core part of ISO 27001 — helps ensure you have inventory, version tracking and an accepted process for urgent patching or isolation of vulnerable components. For practical baseline security controls, Cyber Essentials and IASME certifications are useful ways to ensure basic protections like MFA, secure configurations and patching hygiene are in place.
To keep customers and operations running during a fall‑out from account compromises, ISO 22301 business continuity planning helps you define how to maintain critical services, communicate with customers and recover trust without losing payroll or market share.
People and process matter too
Security awareness training such as usecure reduces the chance of staff being tricked into helping attackers reset accounts or reassign contact details, and should be combined with clear procedures for support staff to verify identity before changing account details.
Longer‑term fixes and resilience advice
Technical debt and insecure-by-design reset workflows are an invitation for trouble. Beyond immediate remediation, sensible organisations should:
-
Embed secure development lifecycle practices and code review for authentication logic.
-
Apply principle of least privilege to account management APIs and ensure secrets are never returned to callers.
-
Use strong rate‑limiting, monitoring and automated incident response playbooks, linked to your business continuity plans.
-
Establish contractual and assurance requirements for third‑party software vendors so that you know how quickly they will patch and what their disclosure practices are.
Action checklist (fast, practical, and realistic)
Here’s a short checklist you can run through this afternoon:
-
Identify whether you use macrozheng mall (version 1.0.3 or earlier) anywhere in your estate.
-
If yes, prioritise patching or removing the vulnerable component; if patching will take time, restrict access to the reset endpoint or apply compensating controls (rate limits, MFA enforcement).
-
Confirm OTPs are never returned in API responses and that logs do not store them in clear text.
-
Turn on MFA for customer accounts and harden support‑staff identity verification processes.
-
Trigger incident response and customer communication plans if you detect suspicious resets or account compromises.
All of these steps are practical outputs from a mature ISO 27001 programme and aligned ISO and assurance activities; they’re not magic — just the boring, effective work security takes.
Patch, verify, and then celebrate quietly — until the next advisory arrives.
Act now: inventory any use of macrozheng mall, block or patch vulnerable versions, and harden your password‑reset processes (and enable MFA) before an account compromise becomes a customer‑facing crisis.
