CVE-2026-24468

OpenAEV versions prior to 2.0.13 expose an account-enumeration flaw via the /api/reset login parameter. If the email does not exist, the API returns 400 Bad Request; if the email exists, it returns 200. This observable response difference enables an attacker to reliably determine which emails are...

CVE-2026-24467 OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0.0 and prior to version 2.0.13, OpenAEV's password reset implementation contains multiple security weaknesses that together allow reliable...

OpenAEV 安全漏洞

OpenAEV is an open-source personal planning platform under the OpenAEV Platform. Versions of OpenAEV from 1.11.0 to 2.0.13 contained security vulnerabilities. These vulnerabilities stemmed from differences in responses made by the/api/reset endpoint for valid and invalid usernames, which could...