2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25050

CVE-2026-25050: Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the NativeAuthenticationStrategy.authenticate() method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In packages/core/src/config/auth/native-authentication-strategy.ts, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25050

CVE-2026-25050:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@vendure/core	npm	< 3.5.3	3.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a timing attack within the NativeAuthenticationStrategy.authenticate method in Vendure. The vulnerability arises because the function's response time differs depending on whether a user exists or not. When a user is not found, the function returns immediately. When a user is found, it performs a computationally intensive password hash comparison. This timing discrepancy allows an attacker to enumerate valid user email addresses.

The provided patch addresses this by introducing a dummy password check when a user is not found. This ensures that the execution time is consistent, regardless of whether the user exists, thus mitigating the timing attack vector. The analysis of the commit 7f0c5556ecddb44a5d5208677a45fdd5923b0cc9 clearly shows the modification in the authenticate function within packages/core/src/config/auth/native-authentication-strategy.ts to add this dummy check. Therefore, NativeAuthenticationStrategy.authenticate is the vulnerable function.

Vulnerable functions

NativeAuthenticationStrategy.authenticate

packages/core/src/config/auth/native-authentication-strategy.ts

The `authenticate` function in the `NativeAuthenticationStrategy` class was vulnerable to a timing attack. If a user was not found, the function would return immediately. However, if the user existed, it would proceed to the password verification step which is computationally more expensive. This difference in execution time allowed an attacker to enumerate valid usernames by measuring the server's response time.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.