CVE-2026-25050
📋 TL;DR
This vulnerability allows attackers to enumerate valid user accounts (email addresses) in Vendure through timing attacks. By measuring response time differences between existing and non-existing accounts (~200-400ms vs ~1-5ms), attackers can identify valid usernames. All Vendure deployments prior to version 3.5.3 are affected.
💻 Affected Systems
- Vendure
📦 What is this software?
Vendure by Vendure
⚠️ Risk & Real-World Impact
Worst Case
Attackers build complete user directory for targeted attacks, enabling credential stuffing, phishing campaigns, or brute-force attacks against known accounts.
Likely Case
Attackers enumerate valid email addresses for spam, phishing, or credential stuffing attacks against the platform.
If Mitigated
With rate limiting and account lockout policies, impact is reduced to reconnaissance only without direct authentication bypass.
🎯 Exploit Status
Timing attacks require statistical analysis but tools exist to automate this. No authentication required to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.3
Vendor Advisory: https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch
Restart Required: Yes
Instructions:
1. Update Vendure to version 3.5.3 or later. 2. Run 'npm update @vendure/core' or update package.json. 3. Restart the Vendure server. 4. Verify the fix by checking version.
🔧 Temporary Workarounds
Rate Limiting
allImplement strict rate limiting on authentication endpoints to make timing attacks impractical
Configure rate limiting middleware (e.g., express-rate-limit) with max 5 requests per minute per IP
Account Lockout
allImplement account lockout after failed attempts to prevent enumeration
Implement lockout policy after 5-10 failed attempts per account
🧯 If You Can't Patch
- Implement WAF rules to detect and block timing attack patterns
- Add artificial delays to all authentication responses to eliminate timing differences
🔍 How to Verify
Check if Vulnerable:
Check package.json for @vendure/core version. If version is less than 3.5.3, system is vulnerable.Check Version:
npm list @vendure/core | grep @vendure/coreVerify Fix Applied:
Verify @vendure/core version is 3.5.3 or higher in package.json and running instance.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts with different usernames from same IP
- Unusual pattern of authentication requests with consistent timing
Network Indicators:
- High volume of POST requests to /admin-api or /shop-api authentication endpoints
- Requests with sequential or dictionary-based username patterns
SIEM Query:
source="vendure" AND (uri_path="/admin-api" OR uri_path="/shop-api") AND http_method="POST" | stats count by src_ip, user_agent | where count > 100