CVE-2026-25050: @vendure/core Timing Attack Vulnerability Allows User Enumeration
Summary
CVE-2026-25050: Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy. Affects @vendure/core versions < 3.5.3. Fixed in 3.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vendure is an open-source headless commerce framework built with TypeScript and Node.js, designed to provide a flexible and customizable platform for building e-commerce applications. It features a modular architecture, allowing developers to extend its capabilities with plugins and customizations. However, a vulnerability in the NativeAuthenticationStrategy can lead to user enumeration, compromising account security.
Vulnerability Detail
The vulnerability arises from the NativeAuthenticationStrategy.authenticate() method, which is susceptible to a timing attack. When a user is not found, the method returns almost instantly (1-5ms), while a valid user password check takes significantly longer (200-400ms due to bcrypt processing). This timing discrepancy allows attackers to determine the existence of user accounts based on response times, leading to potential brute-force or phishing attacks.
How To Fix
Minimum fixed version
3.5.3
This is the first release that contains the fix.
npm install @vendure/core@3.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a dummy bcrypt check for non-existent users to equalize response times. Here’s an example of how to modify the authenticate method:
const user = await this.userService.getUserByEmailAddress(ctx, data.username);
if (!user) {
// Perform a dummy bcrypt check to delay response
await bcrypt.hash('dummyPassword', 12);
return false;
}
const passwordMatch = await this.verifyUserPassword(ctx, user.id, data.password);
This ensures that the response time remains consistent, reducing the risk of user enumeration.
Conclusion
The CVE-2026-25050 vulnerability in the @vendure/core package poses a risk of user enumeration through a timing attack. It is crucial to update to version 3.5.3 or later to mitigate this risk. Implementing the provided workaround can also help protect your application until the update is applied.
See every vulnerability recorded for @vendure/core →
FAQ
CVE-2026-25050 is a vulnerability in the @vendure/core package that allows attackers to enumerate valid usernames through a timing attack.
This vulnerability can lead to account enumeration, enabling attackers to identify valid user accounts and potentially launch targeted attacks.
The CVSS score for this vulnerability is 2.7, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, implement the suggested workaround to mitigate the risk of user enumeration until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vendure/core.
