GHSA-6f65-4fv2-wwch
NoneCVSS
—
EPSS
—
Published
Jan 30, 2026
CISA due date
—
The record
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vendure/core | 0 | 3.5.3 |
Related vulnerabilities
- CVE-2026-25050 Vendure is an open-source headless commerce platform. Same vulnerability
- CVE-2026-40887 Vendure is an open-source headless commerce platform. Also affects @vendure/core
- GHSA-9pp3-53p2-ww9v @vendure/core has a SQL Injection vulnerability Also affects @vendure/core
- CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries… CWE-202
- CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph… CWE-202
- CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model… CWE-202
- CVE-2026-42797 Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. CWE-202
- CVE-2026-40245 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-202