CVE-2026-25050

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the "NativeAuthenticationStrategy.authenticate" method is vulnerable to a timing attack that allows attackers to enumerate valid usernames email addresses. In...