CVE-2026-25597
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Feb 6, 2026
CISA due date
—
The record
PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | prestashop/prestashop | 0 | 8.2.4 |
| Packagist | prestashop/prestashop | 9.0.0-alpha.1 | 9.0.3 |
Related vulnerabilities
- GHSA-67v7-3g49-mxh2 PrestaShop affected by time based enumeration in FO login form Same vulnerability
- CVE-2024-34716 PrestaShop is an open source e-commerce web application. Also affects prestashop/prestashop
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
- CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208