216.73.217.98

CVE-2026-25050

· Published 30/01/2026 16:16 · Modified 30/01/2026 16:16

Labels: CVE-2026-25050 2026-01-30CVE-2026-25050CWE-202[email protected]

Essential information

Published
30/01/2026 16:16
Modified
30/01/2026 16:16
Author
Creator
CVSS
2.7 LOW (v3) 2.7 LOW (v4.0)
CISA KEV
No
CWE
CVSS vector

CVSS metrics

Description

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
vendure / vendure cpe:2.3:a:vendure:vendure:<3.5.3:*:*:*:*:*:*:*

References