CVE-2026-25050 Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Attackers can enumerate valid user accounts via timing differences in authentication, exposing user existence information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25050?
CVE-2026-25050 is a low-severity vulnerability in vendurehq vendure, published on 30 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.
Weakness: CWE-202
Which versions are affected by CVE-2026-25050?
2 open source packages ship an affected version, including @vendure/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@vendure/core npm | All versions | 3.5.3 |
@vendure/core npm | All versions | 3.5.3 |
Products include Vendure Vendure.
How do I fix CVE-2026-25050?
Upgrade @vendure/core to 3.5.3 or later.
Is CVE-2026-25050 being exploited?
There is no known exploitation of CVE-2026-25050 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in vendurehq vendure
Sources
Also known as GHSA-6f65-4fv2-wwch.