PT-2026-33788 · Openaev · Openaev

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-24468

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenAEV versions 1.11.0 through 2.0.12

Description OpenAEV is an open source platform for planning, scheduling, and conducting cyber adversary simulation campaigns and tests. The '/api/reset' endpoint exhibits inconsistent behavior based on whether the provided username exists in the system. When a non-existent email is submitted via the login parameter, the server returns an HTTP 400 response, whereas a valid email triggers an HTTP 200 response. This discrepancy allows an unauthenticated attacker to perform account enumeration by automating requests to identify registered email addresses.

Recommendations Update to version 2.0.13.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-24468

Affected Products

Openaev

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-24468 · Security Note
• https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52 · Note
• https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120 · Note
• https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13 · Note
• https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph · Note
• https://twitter.com/infoflowcloud/status/2046573127048532123 · Twitter Post
• https://twitter.com/CVEnew/status/2046571936965394841 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046308118900961555 · Twitter Post