CVE-2026-25597: 
PHP vulnerability analysis and mitigation

CVE-2026-25597 is a time-based user enumeration vulnerability in the Front Office (FO) login form of PrestaShop, an open-source e-commerce web application. It affects all PrestaShop versions prior to 8.2.4 (in the 8.x branch) and versions 9.0.0 through 9.0.2 (in the 9.x branch). The vulnerability was discovered by Lam Yiu Tung, published on February 6, 2026, and patched on February 3, 2026 with the release of versions 8.2.4 and 9.0.3. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an observable timing discrepancy (CWE-208) in the authentication logic of PrestaShop's customer login functionality. When a login attempt is made, the application responds in measurably different times depending on whether the submitted email address corresponds to an existing customer account — for example, due to differing code paths for account lookup hits versus misses. An unauthenticated remote attacker can exploit this by submitting login requests with candidate email addresses and statistically analyzing response latencies to infer account existence, requiring no privileges or user interaction. The fix, contributed by @matthieu-rolland, normalizes response times to eliminate the timing side-channel (GitHub Advisory, PrestaShop 8.2.4 Release).

Successful exploitation allows an unauthenticated attacker to enumerate valid customer email addresses or usernames registered in a PrestaShop store by systematically probing the login endpoint and measuring response times. This is a confidentiality-only impact — integrity and availability are unaffected. The enumerated account data can be leveraged for targeted phishing campaigns, credential stuffing attacks, or social engineering against identified customers, increasing downstream risk beyond the initial information disclosure (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and is exploitable remotely over the network, making it low-complexity to attempt. The EPSS score is approximately 0.043%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify PrestaShop storefronts running vulnerable versions (prior to 8.2.4 or 9.0.0–9.0.2) using web fingerprinting tools (e.g., Wappalyzer, HTTP response headers, or version-specific page content).
2. Prepare email wordlist: Compile a list of candidate customer email addresses to test, sourced from public data breaches, common patterns, or targeted guessing based on the store's customer base.
3. Send timed login requests: Submit POST requests to the PrestaShop Front Office login endpoint (e.g., /index.php?controller=authentication) with each candidate email and a dummy password, recording precise response times for each request.
4. Analyze timing differences: Compare response times statistically — requests for existing accounts will exhibit a consistently different (typically longer) response time due to additional database lookup or password hashing operations compared to non-existent accounts.
5. Build valid account list: Classify email addresses as valid or invalid based on the timing differential, building a list of confirmed customer accounts for use in follow-on attacks such as phishing or credential stuffing (GitHub Advisory).

• Network: High volume of POST requests to the PrestaShop login endpoint (e.g., /index.php?controller=authentication) from a single IP or small range of IPs, especially with varying email addresses and consistent dummy passwords.
• Logs: Web server access logs showing repeated authentication attempts with many different email addresses in a short time window, potentially with consistent user-agent strings or request intervals indicative of automation.
• Logs: Application logs showing a large number of failed login attempts across many unique email addresses without corresponding successful logins, suggesting enumeration rather than brute-force credential attacks.

PrestaShop has released patches in versions 8.2.4 (for the 8.x branch) and 9.0.3 (for the 9.x branch), which normalize authentication response times to eliminate the timing side-channel. No configuration-based workarounds are available — upgrading to a patched version is the only remediation. Operators running any version below 8.2.4 or versions 9.0.0 through 9.0.2 should upgrade immediately (PrestaShop 8.2.4 Release, PrestaShop 9.0.3 Release). As a supplementary defense-in-depth measure, operators may consider implementing rate limiting or CAPTCHA on the login endpoint to slow automated enumeration attempts.