CVE-2026-25050
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 30, 2026
CISA due date
—
The record
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vendure/core | 0 | 3.5.3 |
Related vulnerabilities
- GHSA-6f65-4fv2-wwch Vendure vulnerable to timing attack that enables user enumeration in… Same vulnerability
- CVE-2026-40887 Vendure is an open-source headless commerce platform. Also affects @vendure/core
- GHSA-9pp3-53p2-ww9v @vendure/core has a SQL Injection vulnerability Also affects @vendure/core
- CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries… CWE-202
- CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph… CWE-202
- CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model… CWE-202
- CVE-2026-42797 Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. CWE-202
- CVE-2026-40245 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-202