CVE-2026-114401
Medium · 5.3CVSS
5.3
EPSS
—
Published
Oct 21, 2026
CISA due date
—
The record
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118645 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter… CWE-943
- CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData… CWE-943
- CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an externally… CWE-943
- CVE-2026-55369 Waline is a comment system with backend support. CWE-943
- CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning… CWE-943
- CVE-2026-57193 Asterisk is an open source private branch exchange and telephony toolkit. CWE-943
- CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943
- CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943