-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key patterns: 1) The password recovery and 2FA reset endpoints performed immediate user existence checks through database lookups (User.get_by_username/email), creating timing side-channels. 2) The 2FA endpoint returned different error semantics ('Failed to login') for existing vs non-existing users. The commit diff shows these functions were modified to add gevent.spawn_later delays and consolidate authentication checks to prevent timing leaks. The pre-patch versions lacked both constant-time response handling and proper credential validation before user existence disclosure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vantage6 | pip | <= 4.2.2 | 4.3.0 |