CVE-2026-25050: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25050 is a timing attack vulnerability in Vendure's NativeAuthenticationStrategy.authenticate() method that enables unauthenticated attackers to enumerate valid user email addresses. It affects all versions of the @vendure/core npm package prior to 3.5.3. The vulnerability was published on January 30, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.7 (Low) (Github Advisory, Vendure Advisory).

The root cause is classified as CWE-202 (Exposure of Sensitive Information Through Data Queries). In packages/core/src/config/auth/native-authentication-strategy.ts, the authenticate() method returns immediately (in ~1–5ms) when a user is not found in the database, but proceeds to perform a bcrypt password verification (taking ~200–400ms with 12 rounds) when the user does exist. This measurable timing discrepancy allows an unauthenticated, remote attacker to distinguish between existing and non-existing accounts by analyzing response latency. No special privileges or user interaction are required. A public proof-of-concept exploit exists on GitHub (Github Advisory, Vendure Advisory).

Successful exploitation allows attackers to systematically enumerate valid user email addresses registered in a Vendure e-commerce instance, constituting an information disclosure (confidentiality) impact with no integrity or availability impact. The enumerated account list can be leveraged for downstream attacks including credential stuffing, targeted brute-force, phishing, and social engineering campaigns against identified users. The attack requires only network access to the authentication endpoint and no credentials, making it broadly accessible to any remote attacker (Github Advisory, Vendure Advisory).

A public proof-of-concept exploit is available on GitHub at https://github.com/Christbowel/CVE-2026-25050, added to tracking on March 2, 2026. The EPSS score is approximately 0.021% (6th percentile), indicating a low but non-zero probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by the researcher known as "Christbowel" (Github Advisory, Vendure Release).

1. Reconnaissance: Identify internet-facing Vendure instances running @vendure/core versions prior to 3.5.3 by examining HTTP response headers, JavaScript bundles, or public e-commerce site indicators.
2. Locate authentication endpoint: Identify the Vendure GraphQL API authentication endpoint (typically /shop-api or /admin-api) that accepts login mutations using the NativeAuthenticationStrategy.
3. Craft authentication requests: Send repeated authenticate GraphQL mutation requests with candidate email addresses (e.g., from a wordlist or generated list) and an arbitrary password.
4. Measure response times: Record the response time for each request. Responses returning in ~1–5ms indicate the email does not exist; responses taking ~200–400ms indicate the email is registered and bcrypt verification was performed.
5. Build valid account list: Compile all email addresses that produced slow responses into a list of confirmed valid accounts for use in follow-on attacks such as credential stuffing or phishing (Github Advisory, Vendure Advisory).

• Network: High volume of authentication requests to the Vendure GraphQL API (/shop-api or /admin-api) from a single IP or small IP range, particularly with varied email addresses and a constant/dummy password.
• Logs: Authentication logs showing large numbers of failed login attempts across many different email addresses in a short time window, with response time patterns clustering around ~1–5ms (non-existent users) and ~200–400ms (existing users).
• Logs: Repeated GraphQL authenticate mutation calls with systematically varied username fields and identical or trivial password values.
• Network: Automated request patterns (consistent inter-request timing, no browser fingerprint, scripted user-agent strings) targeting the authentication endpoint.

The primary remediation is to upgrade @vendure/core to version 3.5.3 or later, which patches the vulnerability by performing a dummy bcrypt check when a user is not found, ensuring consistent response times regardless of account existence (Vendure Release, Github Advisory). For organizations unable to patch immediately, the following interim mitigations are recommended:

• Implement rate limiting on authentication endpoints to slow enumeration attempts.
• Deploy CAPTCHA or bot-protection mechanisms on login forms.
• Monitor authentication logs for patterns indicative of username enumeration (high volume of failed attempts across many different email addresses).
• Consider adding a web application firewall (WAF) rule to throttle or block automated authentication requests.

The vulnerability was responsibly disclosed by the researcher "Christbowel," who is credited in the official Vendure v3.5.3 release notes (Vendure Release). The Vendure maintainer michaelbromley published the security advisory and patch on January 30, 2026, classifying the issue as low severity. Community discussion was noted on Bluesky and aggregated by vulnerability tracking services shortly after disclosure, though no significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.