PT-2026-6377 · Packagist · Prestashop/Prestashop

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impact

A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.

Patches

8.2.4 and 9.0.3

Workarounds

none

References

Found by Lam Yiu Tung

Fix

Weakness Enumeration

CWE-208

Related Identifiers

GHSA-67V7-3G49-MXH2

Affected Products

Prestashop/Prestashop

References · 6

• https://osv.dev/vulnerability/GHSA-67v7-3g49-mxh2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25597 · Security Note
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2 · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3 · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4 · Note