CVE-2026-81033 Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy
Unauthenticated attackers can enumerate registered user accounts by analyzing response discrepancies in the forgot-password endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81033?
CVE-2026-81033 is a medium-severity vulnerability in automatisch, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.
Weakness: CWE-204
Which versions are affected by CVE-2026-81033?
How do I fix CVE-2026-81033?
No fix has been published for CVE-2026-81033 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81033 being exploited?
There is no known exploitation of CVE-2026-81033 in the wild and no public exploit code.
Sources
Also known as GHSA-p996-89cm-88c6.