Security readout for executives and security teams
Plain-English summary
CVE-2026-25050 affects Vendure, an open-source commerce platform. Before version 3.5.3, the native login flow can respond at measurably different speeds for real versus non-existent email addresses. An attacker could use that difference to enumerate customer or admin accounts. The issue is rated low, but it can support phishing or credential-stuffing activity.
Executive priority
Treat as a low-severity but privacy-relevant issue. Prioritize routine patching for public commerce sites, especially where customer email privacy and phishing resilience matter. This is not described as account takeover or code execution, but upgrading reduces attacker reconnaissance value.
Technical view
Vendure versions before 3.5.3 have a CWE-202 observable discrepancy in NativeAuthenticationStrategy.authenticate(). The method returns quickly when no user is found, while valid users trigger bcrypt work, creating a reported ~200-400ms versus ~1-5ms timing gap. The CVSS v4.0 score is 2.7, network exploitable, unauthenticated, with low confidentiality impact only.
Likely exposure
Exposure is most relevant for internet-accessible Vendure deployments using NativeAuthenticationStrategy for email/password authentication. The known affected product is vendurehq Vendure before 3.5.3. The provided sources do not identify other affected products, hosted services, or configurations beyond this native authentication path.
Exploitation context
No CISA KEV listing or cited source indicates active exploitation. Practical abuse would require repeated authentication attempts and timing measurement to infer valid email addresses. The vulnerability does not provide account access by itself, but confirmed account lists may increase phishing, password-spraying, or credential-stuffing risk.
Researcher notes
The key weakness is user enumeration through response-time discrepancy in authenticate(). Sources attribute the gap to immediate return on database miss versus bcrypt processing for existing users. Evidence provided does not include exploit availability, field exploitation, or additional mitigations beyond version 3.5.3 fixing the issue.
Mitigation direction
- Upgrade Vendure to version 3.5.3 or later.
- Review the GitHub security advisory for vendor-specific guidance.
- Inventory public Vendure login endpoints using NativeAuthenticationStrategy.
- Monitor authentication activity for unusual high-volume username probing.
Validation and detection
- Confirm the deployed Vendure version is 3.5.3 or later.
- Identify whether NativeAuthenticationStrategy is enabled for login.
- Check dependency manifests and container images for Vendure versions below 3.5.3.
- Review authentication logs for repeated attempts across many email addresses.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-202: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25050 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
2.7LowVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwchCVE reference · x_refsource_CONFIRM
- https://github.com/vendurehq/vendure/releases/tag/v3.5.3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information Through Data Queries
Exposure of Sensitive Information Through Data Queries represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.