PT-2026-5409 · Vendure · Vendure

Christbowel · Publicado 2026-01-30 · Atualizado 2026-02-06 · CVE-2026-25050

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.5.3

Description Vendure, an open-source headless commerce platform, contains a flaw in the NativeAuthenticationStrategy.authenticate() method. This issue allows attackers to enumerate valid usernames (email addresses) through a timing attack. The authenticate method, located in packages/core/src/config/auth/native-authentication-strategy.ts, returns quickly if a user is not found, while authentication attempts with valid users experience a noticeable delay due to bcrypt processing. This timing difference enables attackers to reliably determine the existence of accounts.

Recommendations Update to version 3.5.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-202

Identificadores relacionados

CVE-2026-25050

GHSA-6F65-4FV2-WWCH

Produtos afetados

Vendure

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25050.json · Exploit
• https://github.com/vendurehq/vendure · Nota
• https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch · Aviso do Fabricante
• https://github.com/vendurehq/vendure/commit/7f0c5556ecddb44a5d5208677a45fdd5923b0cc9 · Nota
• https://github.com/vendurehq/vendure/releases/tag/v3.5.3 · Nota
• https://twitter.com/CVEnew/status/2017264936788050286 · Publicação no Twitter
• https://twitter.com/christbowel10/status/2019887693665050986 · Publicação no Twitter
• https://t.me/CVEtracker/43290 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-25050 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25050 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6f65-4fv2-wwch · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2017280474469568795 · Publicação no Twitter