-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the username field not enforcing case-insensitive uniqueness, allowing multiple users with the same username in different cases. The authenticate function in login.py used a case-sensitive query (filter_by(username=username)), which could return different users based on case. The UserObject.get_user method also performed case-sensitive lookups, failing to enforce consistent user identification. The patch introduced a case-insensitive index on the username and modified get_user to use func.lower(), addressing these issues. The vulnerable functions directly handled user authentication and lookup without case-insensitive checks, enabling the exploit.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rdiffweb | pip | < 2.5.5 | 2.5.5 |