CVE-2026-25050
CVE-2026-25050 · Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.
CVSS 2.7 · Baja · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
vendure
- Versiones
- < 3.5.3: Afectada
Sin corrección publicada
@vendure/core npm
- Intervalos de versiones afectados
- SEMVER: < 3.5.3
Actualiza a 3.5.3