GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-204

Allowed

Observable Response Discrepancy

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

341 vulnerabilities reference this CWE, most recent first.

GHSA-CR7P-CR3Q-H5CM

Vulnerability from github – Published: 2026-07-24 21:43 – Updated: 2026-08-12 18:56
VLAI
Summary
Budibase: Account Enumeration via Login Lockout Response Differential
Details

Summary

The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct 403 response with X-Account-Locked: 1 and Retry-After: 900 headers plus the message "Account temporarily locked." For non-existing users, the response is always a generic 403 "Unauthorized" regardless of attempt count, because the lockout counter is never incremented.

Details

The vulnerability exists in two files that implement the login lockout feature:

packages/worker/src/middleware/lockout.ts:18-36 — The lockout middleware only blocks requests for users that exist in the database AND are locked:

export default async (ctx: Ctx, next: Next) => {
  const email = ctx.request.body.username
  if (!email) {
    return await next()
  }
  const dbUser = await userSdk.db.getUserByEmail(email)
  if (dbUser && (await isLocked(email))) {  // line 26: non-existing users skip this entirely
    ctx.set("X-Account-Locked", "1")
    ctx.set("Retry-After", String(env.LOGIN_LOCKOUT_SECONDS))
    ctx.throw(403, "Account temporarily locked. Try again later.")
  }
  return await next()
}

packages/worker/src/api/controllers/global/auth.ts:127-141 — The login handler only increments the failure counter for existing users:

if (err || !user) {
  if (dbUser) {          // line 129: non-existing users never trigger onFailed()
    await onFailed(email)
  }
  if (await isLocked(email)) {
    return handleLockoutResponse(ctx, email)
  }
  // ...
  return passportCallback(ctx, user as any, err, info)
}

Execution flow for existing users (after 5 failed attempts): 1. lockout middleware → getUserByEmail returns user → isLocked returns true → 403 + X-Account-Locked: 1 + Retry-After: 900 + "Account temporarily locked"

Execution flow for non-existing users (any number of attempts): 1. lockout middleware → getUserByEmail returns null → dbUser && isLocked is false → passes through 2. Login handler → passport fails → if (dbUser) is false → onFailed() never called → lock never set 3. Always returns 403 "Unauthorized"

No IP-based rate limiting exists on the login endpoint (POST /api/global/auth/:tenantId/login). The route is registered via loggedInRoutes which applies no authentication middleware. The password reset endpoint has proper IP-based rate limiting, but the login endpoint does not.

PoC

# Test against a known-existing email and a non-existing email
# Replace 'default' with the target tenant ID

# Step 1: Send 6 login attempts for an existing user
echo "=== Testing existing user ==="
for i in $(seq 1 6); do
  echo "--- Attempt $i ---"
  curl -s -D - -X POST http://localhost:10000/api/global/auth/default/login \
    -H 'Content-Type: application/json' \
    -d '{"username":"local@budibase.com","password":"wrongpassword"}' 2>&1 \
    | grep -E 'HTTP/|X-Account-Locked|Retry-After|locked|Unauthorized'
  echo ""
done

# Expected: Attempts 1-5 return "Unauthorized"
# Attempt 6 returns: "Account temporarily locked" + X-Account-Locked: 1 + Retry-After: 900

# Step 2: Send 6 login attempts for a non-existing user
echo "=== Testing non-existing user ==="
for i in $(seq 1 6); do
  echo "--- Attempt $i ---"
  curl -s -D - -X POST http://localhost:10000/api/global/auth/default/login \
    -H 'Content-Type: application/json' \
    -d '{"username":"nonexistent@example.com","password":"wrongpassword"}' 2>&1 \
    | grep -E 'HTTP/|X-Account-Locked|Retry-After|locked|Unauthorized'
  echo ""
done

# Expected: All 6 attempts return "Unauthorized" — no lockout ever triggers

# The difference in behavior after 5 attempts confirms whether the email exists.

Impact

  • Account enumeration: An unauthenticated attacker can determine whether any email address is registered on a Budibase tenant by sending 5-6 login requests and observing whether the response changes to "Account temporarily locked" with the X-Account-Locked header.
  • No rate limiting: The login endpoint has no IP-based rate limiting, allowing an attacker to enumerate emails at high speed from a single IP address (~5 requests per email).
  • Denial of service side-effect: Each enumerated existing email is locked out for 15 minutes (900 seconds), preventing legitimate users from logging in during that window.
  • Enables further attacks: Confirmed valid emails can be used for targeted phishing, credential stuffing against other services, or social engineering.

Recommended Fix

The lockout behavior should be identical regardless of whether the user exists. Apply lockout tracking based on the email string itself, not conditioned on database user existence:

packages/worker/src/middleware/lockout.ts — Remove the dbUser check:

export default async (ctx: Ctx, next: Next) => {
  const email = ctx.request.body.username
  if (!email) {
    return await next()
  }
  // Check lock status based on email alone, not user existence
  if (await isLocked(email)) {
    ctx.set("X-Account-Locked", "1")
    ctx.set("Retry-After", String(env.LOGIN_LOCKOUT_SECONDS))
    ctx.throw(403, "Account temporarily locked. Try again later.")
  }
  return await next()
}

packages/worker/src/api/controllers/global/auth.ts — Remove the dbUser guard around onFailed:

if (err || !user) {
  // Always increment failure counter regardless of user existence
  await onFailed(email)
  if (await isLocked(email)) {
    return handleLockoutResponse(ctx, email)
  }
  // ...
}

Additionally, consider adding IP-based rate limiting to the login endpoint (similar to what already exists on the password reset endpoint) to limit enumeration throughput.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:43:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user\u0027s account is locked after 5 failed login attempts, the server returns a distinct `403` response with `X-Account-Locked: 1` and `Retry-After: 900` headers plus the message \"Account temporarily locked.\" For non-existing users, the response is always a generic `403 \"Unauthorized\"` regardless of attempt count, because the lockout counter is never incremented.\n\n## Details\n\nThe vulnerability exists in two files that implement the login lockout feature:\n\n**`packages/worker/src/middleware/lockout.ts:18-36`** \u2014 The lockout middleware only blocks requests for users that exist in the database AND are locked:\n\n```typescript\nexport default async (ctx: Ctx, next: Next) =\u003e {\n  const email = ctx.request.body.username\n  if (!email) {\n    return await next()\n  }\n  const dbUser = await userSdk.db.getUserByEmail(email)\n  if (dbUser \u0026\u0026 (await isLocked(email))) {  // line 26: non-existing users skip this entirely\n    ctx.set(\"X-Account-Locked\", \"1\")\n    ctx.set(\"Retry-After\", String(env.LOGIN_LOCKOUT_SECONDS))\n    ctx.throw(403, \"Account temporarily locked. Try again later.\")\n  }\n  return await next()\n}\n```\n\n**`packages/worker/src/api/controllers/global/auth.ts:127-141`** \u2014 The login handler only increments the failure counter for existing users:\n\n```typescript\nif (err || !user) {\n  if (dbUser) {          // line 129: non-existing users never trigger onFailed()\n    await onFailed(email)\n  }\n  if (await isLocked(email)) {\n    return handleLockoutResponse(ctx, email)\n  }\n  // ...\n  return passportCallback(ctx, user as any, err, info)\n}\n```\n\n**Execution flow for existing users (after 5 failed attempts):**\n1. `lockout` middleware \u2192 `getUserByEmail` returns user \u2192 `isLocked` returns true \u2192 403 + `X-Account-Locked: 1` + `Retry-After: 900` + \"Account temporarily locked\"\n\n**Execution flow for non-existing users (any number of attempts):**\n1. `lockout` middleware \u2192 `getUserByEmail` returns null \u2192 `dbUser \u0026\u0026 isLocked` is false \u2192 passes through\n2. Login handler \u2192 passport fails \u2192 `if (dbUser)` is false \u2192 `onFailed()` never called \u2192 lock never set\n3. Always returns 403 \"Unauthorized\"\n\nNo IP-based rate limiting exists on the login endpoint (`POST /api/global/auth/:tenantId/login`). The route is registered via `loggedInRoutes` which applies no authentication middleware. The password reset endpoint has proper IP-based rate limiting, but the login endpoint does not.\n\n## PoC\n\n```bash\n# Test against a known-existing email and a non-existing email\n# Replace \u0027default\u0027 with the target tenant ID\n\n# Step 1: Send 6 login attempts for an existing user\necho \"=== Testing existing user ===\"\nfor i in $(seq 1 6); do\n  echo \"--- Attempt $i ---\"\n  curl -s -D - -X POST http://localhost:10000/api/global/auth/default/login \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"username\":\"local@budibase.com\",\"password\":\"wrongpassword\"}\u0027 2\u003e\u00261 \\\n    | grep -E \u0027HTTP/|X-Account-Locked|Retry-After|locked|Unauthorized\u0027\n  echo \"\"\ndone\n\n# Expected: Attempts 1-5 return \"Unauthorized\"\n# Attempt 6 returns: \"Account temporarily locked\" + X-Account-Locked: 1 + Retry-After: 900\n\n# Step 2: Send 6 login attempts for a non-existing user\necho \"=== Testing non-existing user ===\"\nfor i in $(seq 1 6); do\n  echo \"--- Attempt $i ---\"\n  curl -s -D - -X POST http://localhost:10000/api/global/auth/default/login \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"username\":\"nonexistent@example.com\",\"password\":\"wrongpassword\"}\u0027 2\u003e\u00261 \\\n    | grep -E \u0027HTTP/|X-Account-Locked|Retry-After|locked|Unauthorized\u0027\n  echo \"\"\ndone\n\n# Expected: All 6 attempts return \"Unauthorized\" \u2014 no lockout ever triggers\n\n# The difference in behavior after 5 attempts confirms whether the email exists.\n```\n\n## Impact\n\n- **Account enumeration**: An unauthenticated attacker can determine whether any email address is registered on a Budibase tenant by sending 5-6 login requests and observing whether the response changes to \"Account temporarily locked\" with the `X-Account-Locked` header.\n- **No rate limiting**: The login endpoint has no IP-based rate limiting, allowing an attacker to enumerate emails at high speed from a single IP address (~5 requests per email).\n- **Denial of service side-effect**: Each enumerated existing email is locked out for 15 minutes (900 seconds), preventing legitimate users from logging in during that window.\n- **Enables further attacks**: Confirmed valid emails can be used for targeted phishing, credential stuffing against other services, or social engineering.\n\n## Recommended Fix\n\nThe lockout behavior should be identical regardless of whether the user exists. Apply lockout tracking based on the email string itself, not conditioned on database user existence:\n\n**`packages/worker/src/middleware/lockout.ts`** \u2014 Remove the `dbUser` check:\n\n```typescript\nexport default async (ctx: Ctx, next: Next) =\u003e {\n  const email = ctx.request.body.username\n  if (!email) {\n    return await next()\n  }\n  // Check lock status based on email alone, not user existence\n  if (await isLocked(email)) {\n    ctx.set(\"X-Account-Locked\", \"1\")\n    ctx.set(\"Retry-After\", String(env.LOGIN_LOCKOUT_SECONDS))\n    ctx.throw(403, \"Account temporarily locked. Try again later.\")\n  }\n  return await next()\n}\n```\n\n**`packages/worker/src/api/controllers/global/auth.ts`** \u2014 Remove the `dbUser` guard around `onFailed`:\n\n```typescript\nif (err || !user) {\n  // Always increment failure counter regardless of user existence\n  await onFailed(email)\n  if (await isLocked(email)) {\n    return handleLockoutResponse(ctx, email)\n  }\n  // ...\n}\n```\n\nAdditionally, consider adding IP-based rate limiting to the login endpoint (similar to what already exists on the password reset endpoint) to limit enumeration throughput.",
  "id": "GHSA-cr7p-cr3q-h5cm",
  "modified": "2026-08-12T18:56:22Z",
  "published": "2026-07-24T21:43:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Account Enumeration via Login Lockout Response Differential"
}

GHSA-CV2M-5PFP-F245

Vulnerability from github – Published: 2025-09-02 15:31 – Updated: 2025-09-02 20:27
VLAI
Summary
Silverpeas Core Username Enumeration Vulnerability
Details

A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.silverpeas.core:silverpeas-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4.1"
            },
            {
              "fixed": "6.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-46047"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-02T20:27:20Z",
    "nvd_published_at": "2025-09-02T14:15:34Z",
    "severity": "MODERATE"
  },
  "details": "A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.",
  "id": "GHSA-cv2m-5pfp-f245",
  "modified": "2025-09-02T20:27:21Z",
  "published": "2025-09-02T15:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46047"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Silverpeas/Silverpeas-Core/pull/1399"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Silverpeas/Silverpeas-Core/commit/c283ce13d81ba7abf6adcd226338c95c5875a398"
    },
    {
      "type": "WEB",
      "url": "https://github.com/J0ey17/Silverpeas-Username-Enumeration-PoC"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Silverpeas/Silverpeas-Core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Silverpeas Core Username Enumeration Vulnerability"
}

GHSA-F7J7-J734-VM9X

Vulnerability from github – Published: 2025-04-08 09:31 – Updated: 2025-04-08 09:31
VLAI
Details

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions), Mendix Runtime V10.18 (All versions), Mendix Runtime V10.6 (All versions), Mendix Runtime V8 (All versions), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-30280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-08T09:15:27Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in Mendix Runtime V10 (All versions \u003c V10.21.0), Mendix Runtime V10.12 (All versions), Mendix Runtime V10.18 (All versions), Mendix Runtime V10.6 (All versions), Mendix Runtime V8 (All versions), Mendix Runtime V9 (All versions \u003c V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.",
  "id": "GHSA-f7j7-j734-vm9x",
  "modified": "2025-04-08T09:31:12Z",
  "published": "2025-04-08T09:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30280"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-874353.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F8XM-42J5-9Q25

Vulnerability from github – Published: 2026-09-10 15:33 – Updated: 2026-09-10 15:33
VLAI
Details

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting.

This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-9161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T13:20:33Z",
    "severity": "MODERATE"
  },
  "details": "Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting.\n\nThis issue affects Website Template: through 10092026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-f8xm-42j5-9q25",
  "modified": "2026-09-10T15:33:13Z",
  "published": "2026-09-10T15:33:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9161"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1062"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FFF6-X26H-Q5RP

Vulnerability from github – Published: 2025-10-16 21:31 – Updated: 2025-10-30 18:31
VLAI
Details

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the data.exist boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-34255"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-16T19:15:32Z",
    "severity": "MODERATE"
  },
  "details": "D-Link Nuclias Connect firmware versions \u003c= 1.3.1.4 contain an observable response discrepancy vulnerability.\u00a0The application\u0027s \u0027Forgot Password\u0027 endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server.\u00a0NOTE: D-Link states that a fix is under development.",
  "id": "GHSA-fff6-x26h-q5rp",
  "modified": "2025-10-30T18:31:07Z",
  "published": "2025-10-16T21:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34255"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10472"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/for-business/nuclias/nuclias-connect"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dlink-nuclias-connect-forgot-password-account-enumeration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FGMC-2HQJ-86V4

Vulnerability from github – Published: 2026-06-05 16:45 – Updated: 2026-07-09 21:06
VLAI
Summary
Vantage6: Set admin user and password from environment or configuration
Details

Impact

Vantage6 currently provides an initial user with username root and password root. This is not ideal for the following reasons: - Attackers know that almost all vantage6 servers have a user with username root that probably has admin rights - The initial password is very weak and it is possible that administrators forget to reset it.

Patches

No

Workarounds

It is possible to delete the root user after it has been used to create other users

References

We could consider doing this like mongodb

Additional info

Luis uses the following patch to mitigate it:

diff --git a/vantage6-server/vantage6/server/__init__.py b/vantage6-server/vantage6/server/__init__.py
index ea362c1e..c6dcbbd9 100644
--- a/vantage6-server/vantage6/server/__init__.py
+++ b/vantage6-server/vantage6/server/__init__.py
@@ -618,18 +618,30 @@ class ServerApp:
             # TODO use constant instead of 'Root' literal
             root = db.Role.get_by_name("Root")

-            log.warn(
-                f"Creating root user: "
-                f"username={SUPER_USER_INFO['username']}, "
-                f"password={SUPER_USER_INFO['password']}"
-            )
+            # Temporary patch
+            # read initial root password from file (docker secret) if provided
+            # TODO: This is a workaround so we don't have an insecure vserver
+            #       at the start. Ideally, we would provide an already hashed
+            #       password. But as hashing is implemented via @validates on
+            #       the field 'password', there isn't a nice way around this.
+            if os.environ.get("V6_INITIAL_ROOT_PASSWORD_FILE"):
+                with open(
+                    os.environ.get("V6_INITIAL_ROOT_PASSWORD_FILE")
+                ) as password_file:
+                    initial_root_password = password_file.read().strip()
+                log.info(
+                    f"Creating root user with password provided via V6_INITIAL_ROOT_PASSWORD_FILE"
+                )
+            else:
+                initial_root_password = SUPER_USER_INFO["password"]
+                log.warn(f"Creating root user with default credentials!")

             user = db.User(
                 username=SUPER_USER_INFO["username"],
                 roles=[root],
                 organization=org,
                 email="root@domain.ext",
-                password=SUPER_USER_INFO["password"],
+                password=initial_root_password,
                 failed_login_attempts=0,
                 last_login_attempt=None,
             )
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "vantage6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54445"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1393",
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:45:22Z",
    "nvd_published_at": "2026-06-17T23:17:05Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nVantage6 currently provides an initial user with username `root` and password `root`. This is not ideal for the following reasons:\n- Attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights\n- The initial password is very weak and it is possible that administrators forget to reset it.\n\n### Patches\nNo\n\n### Workarounds\nIt is possible to delete the `root` user after it has been used to create other users\n\n### References\nWe could consider doing this like [mongodb](https://hub.docker.com/_/mongo)\n\n### Additional info\n\nLuis uses the following patch to mitigate it:\n```diff\ndiff --git a/vantage6-server/vantage6/server/__init__.py b/vantage6-server/vantage6/server/__init__.py\nindex ea362c1e..c6dcbbd9 100644\n--- a/vantage6-server/vantage6/server/__init__.py\n+++ b/vantage6-server/vantage6/server/__init__.py\n@@ -618,18 +618,30 @@ class ServerApp:\n             # TODO use constant instead of \u0027Root\u0027 literal\n             root = db.Role.get_by_name(\"Root\")\n \n-            log.warn(\n-                f\"Creating root user: \"\n-                f\"username={SUPER_USER_INFO[\u0027username\u0027]}, \"\n-                f\"password={SUPER_USER_INFO[\u0027password\u0027]}\"\n-            )\n+            # Temporary patch\n+            # read initial root password from file (docker secret) if provided\n+            # TODO: This is a workaround so we don\u0027t have an insecure vserver\n+            #       at the start. Ideally, we would provide an already hashed\n+            #       password. But as hashing is implemented via @validates on\n+            #       the field \u0027password\u0027, there isn\u0027t a nice way around this.\n+            if os.environ.get(\"V6_INITIAL_ROOT_PASSWORD_FILE\"):\n+                with open(\n+                    os.environ.get(\"V6_INITIAL_ROOT_PASSWORD_FILE\")\n+                ) as password_file:\n+                    initial_root_password = password_file.read().strip()\n+                log.info(\n+                    f\"Creating root user with password provided via V6_INITIAL_ROOT_PASSWORD_FILE\"\n+                )\n+            else:\n+                initial_root_password = SUPER_USER_INFO[\"password\"]\n+                log.warn(f\"Creating root user with default credentials!\")\n \n             user = db.User(\n                 username=SUPER_USER_INFO[\"username\"],\n                 roles=[root],\n                 organization=org,\n                 email=\"root@domain.ext\",\n-                password=SUPER_USER_INFO[\"password\"],\n+                password=initial_root_password,\n                 failed_login_attempts=0,\n                 last_login_attempt=None,\n             )\n```",
  "id": "GHSA-fgmc-2hqj-86v4",
  "modified": "2026-07-09T21:06:52Z",
  "published": "2026-06-05T16:45:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54445"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vantage6/vantage6/issues/1932"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vantage6/vantage6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vantage6: Set admin user and password from environment or configuration"
}

GHSA-FVCV-8G7R-6893

Vulnerability from github – Published: 2026-04-09 15:35 – Updated: 2026-04-13 21:30
VLAI
Details

An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4113"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-09T15:16:13Z",
    "severity": "HIGH"
  },
  "details": "An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.",
  "id": "GHSA-fvcv-8g7r-6893",
  "modified": "2026-04-13T21:30:39Z",
  "published": "2026-04-09T15:35:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4113"
    },
    {
      "type": "WEB",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G4WF-PJGV-XRC5

Vulnerability from github – Published: 2025-05-20 18:30 – Updated: 2025-05-20 18:30
VLAI
Details

Failed login response could be different depending on whether the username was local or central.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-48015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-20T16:15:35Z",
    "severity": "LOW"
  },
  "details": "Failed login response could be different depending on whether the username was local or central.",
  "id": "GHSA-g4wf-pjgv-xrc5",
  "modified": "2025-05-20T18:30:57Z",
  "published": "2025-05-20T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48015"
    },
    {
      "type": "WEB",
      "url": "https://selinc.com/products/software/latest-software-versions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G55H-GQ76-W8V9

Vulnerability from github – Published: 2023-10-31 18:31 – Updated: 2023-11-08 18:30
VLAI
Details

An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-37831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-31T18:15:08Z",
    "severity": "MODERATE"
  },
  "details": "An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.",
  "id": "GHSA-g55h-gq76-w8v9",
  "modified": "2023-11-08T18:30:31Z",
  "published": "2023-10-31T18:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37831"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strik3r0x1/Vulns/blob/main/User%20enumeration%20-%20Elenos.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G58R-FCX4-MV8R

Vulnerability from github – Published: 2025-01-14 15:30 – Updated: 2025-01-14 15:30
VLAI
Details

An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to enumerate valid users via observing login request responses.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-36510"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T14:15:30Z",
    "severity": "MODERATE"
  },
  "details": "An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to enumerate valid users via observing login request responses.",
  "id": "GHSA-g58r-fcx4-mv8r",
  "modified": "2025-01-14T15:30:53Z",
  "published": "2025-01-14T15:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36510"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-071"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
Implementation
  • Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
  • If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
  • Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-331: ICMP IP Total Length Field Probe

An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.

CAPEC-332: ICMP IP 'ID' Field Error Message Probe

An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

CAPEC-541: Application Fingerprinting

An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.

CAPEC-580: System Footprinting

An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.

← Back to the CWE list