PT-2026-6549 · Unknown · Prestashop

Lam Yiu Tung · Published 2026-02-03 · Updated 2026-02-11 · CVE-2026-25597

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.2.4 PrestaShop versions prior to 9.0.3

Description PrestaShop contains a time-based user enumeration issue in its user authentication functionality. An attacker can determine if a customer account exists by observing response times. The vulnerable functionality does not involve any API endpoints or specific parameters. The authenticate() function is affected.

Recommendations Update to PrestaShop version 8.2.4 or later. Update to PrestaShop version 9.0.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

BIT-PRESTASHOP-2026-25597

CVE-2026-25597

GHSA-67V7-3G49-MXH2

Affected Products

Prestashop

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25597.json · Exploit
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25597 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67v7-3g49-mxh2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25597 · Security Note
• https://osv.dev/vulnerability/BIT-prestashop-2026-25597 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4 · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3 · Note
• https://twitter.com/Tlam56211480/status/2021566027939951071 · Twitter Post
• https://twitter.com/CVEnew/status/2019885535083573254 · Twitter Post