20 matches found
EUVD-2026-46407
djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...
EUVD-2026-45405
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...
CVE-2026-10130 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...
CVE-2026-10130 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...
CVE-2026-10130
QueryWeaver (CVE-2026-10130) contains an authentication bypass where the signup route unconditionally creates and links a new token to the victim Identity via a Cypher MERGE before verifying email ownership, enabling unauthenticated attackers to obtain valid session tokens for existing accounts a...
PT-2026-60204
Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.36.0 Description The SSO login flow fails to verify the email verified claim from the Identity Provider IdP when the SSO SIGNUPS MATCH EMAIL variable is set to true during the linking of an IdP identity to an...
CVE-2026-28288
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue...
CVE-2026-28288 Dify has a user enumeration issue
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue...
EUVD-2021-30092
Malicious code in bioql PyPI...
CVE-2025-5821 Case Theme User <= 1.0.3 - Authentication Bypass via Social Login
The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebookajaxlogincallback function. This makes it possible f...
Improper Input Validation
org.keycloak:keycloak-services is vulnerable to Improper Input Validation. The vulnerability is due to the use of email as a username without checking for existing accounts, which can lead to the inability to reset or login with email for the user...
GHSA-4VC8-PG5C-VG4X Keycloak's improper input validation allows using email as username
Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails...
CVE-2022-21659
Removed by vendor...
CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...
CVE-2020-36176
The iThemes Security formerly Better WP Security plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs...
CVE-2020-36176
The iThemes Security formerly Better WP Security plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs...
CVE-2020-36176
The iThemes Security formerly Better WP Security plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs...
Timing Attack
Oak Core is vulnerable to timing attacks. Different responses are given for existing and non-existing user names from the server, allowing attackers to focus on guessing passwords for existing accounts...
