Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

Untriaged
Filter by:
With package: python313Packages.flask-marshmallow

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-25858
created 2 months, 1 week ago Activity log
  • Created suggestion 2 months, 1 week ago
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.

Affected products

mall
  • =<1.0.3

Matching in nixpkgs

pkgs.dmalloc

Debug Malloc memory allocation debugging C library

pkgs.mimalloc

Compact, fast, general-purpose memory allocator

pkgs.kicad-small

Open Source Electronics Design Automation suite, without 3D models