CVE-2026-25138: Rucio WebUI Username Enumeration via Login Error Message
Summary
CVE-2026-25138: Rucio WebUI has Username Enumeration via Login Error Message. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio WebUI is a web-based interface for managing data in distributed computing environments, primarily used in scientific research. It provides functionalities for data management, including storage, retrieval, and sharing of datasets. However, it is vulnerable to a specific issue that allows attackers to enumerate valid usernames through distinct error messages returned during the login process.
Vulnerability Detail
The vulnerability arises from the WebUI login endpoint's behavior when handling authentication failures. When an invalid username is submitted, the system returns a specific error message indicating that no account is associated with that username. Conversely, if a valid username is provided but the password is incorrect, a different error message is returned. This discrepancy allows attackers to determine which usernames are valid, potentially leading to targeted attacks such as password guessing or credential stuffing.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, modify the login error handling to return a generic authentication failure message for all login attempts, regardless of whether the username exists. This can be done by adjusting the error response logic in the WebUI codebase to avoid disclosing specific information about account existence.
Conclusion
The Rucio WebUI vulnerability CVE-2026-25138 allows for username enumeration through distinct error messages during the login process. It is crucial to update to the patched versions of the package to mitigate this risk and protect user accounts from potential attacks.
See every vulnerability recorded for rucio-webui →
FAQ
Username enumeration is a security vulnerability that allows attackers to identify valid usernames in a system by analyzing error messages or responses.
An attacker can exploit this vulnerability by attempting to log in with various usernames and observing the error messages returned, allowing them to compile a list of valid usernames.
The consequences include increased risk of targeted attacks, such as password guessing, credential stuffing, and social engineering, which can compromise user accounts.
Yes, patches are available in versions 35.8.3, 38.5.4, and 39.3.1 of the Rucio WebUI package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
