CVE-2024-39211

Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a useremail field only if the user account exists...

CVE-2024-39211

Kaiten version 57.128.8 , an employee management platform, is vulnerable to remote user account enumeration. An attacker can send a crafted POST request to the login endpoint; the system responds with a user_email field only if the account exists, allowing for unrestricted brute force attacks to ...