CVE-2026-24468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24468", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T00:38:20.546Z", "datePublished": "2026-04-20T15:45:48.572Z", "dateUpdated": "2026-04-20T16:24:44.061Z"}, "containers": {"cna": {"title": "OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API", "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph"}, {"name": "https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"}, {"name": "https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120"}, {"name": "https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13"}], "affected": [{"vendor": "OpenAEV-Platform", "product": "openaev", "versions": [{"version": ">= 1.11.0, < 2.0.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T15:45:48.572Z"}, "descriptions": [{"lang": "en", "value": "OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue."}], "source": {"advisory": "GHSA-v6rg-hf9w-f8ph", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:24:28.716507Z", "id": "CVE-2026-24468", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:24:44.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24468", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:24:28.716507Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:24:39.346Z"}}], "cna": {"title": "OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API", "source": {"advisory": "GHSA-v6rg-hf9w-f8ph", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "OpenAEV-Platform", "product": "openaev", "versions": [{"status": "affected", "version": ">= 1.11.0, < 2.0.13"}]}], "references": [{"url": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph", "name": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52", "name": "https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120", "name": "https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13", "name": "https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T15:45:48.572Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24468", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:24:44.061Z", "dateReserved": "2026-01-23T00:38:20.546Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-20T15:45:48.572Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openaev", "vendor": "OpenAEV-Platform", "versions": [{"status": "affected", "version": ">= 1.11.0, < 2.0.13"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue."}], "id": "CVE-2026-24468", "lastModified": "2026-06-17T10:23:06.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24468", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:24:28.716507Z", "version": "2.0.3"}}]}, "published": "2026-04-20T16:16:41.617", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.11.0,2.0.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "openaev", "source": "cna", "vendor": "OpenAEV-Platform"}, "product": "openaev", "vendor": "openaev-platform"}], "analysis": {"en": {"generated_at": "2026-04-20T18:39:21.990578+00:00", "value": {"mitigation_remediation": ["Upgrade OpenAEV to version\u202f2.0.13 or later, where the password\u2011reset endpoint no longer leaks account existence.", "If an immediate upgrade is not possible, modify the /api/reset implementation to return a constant status code (for example, HTTP\u202f200 with a generic message) regardless of whether the email is registered, thereby eliminating the discrepancy.", "Enforce input validation and apply rate limiting or request throttling on the /api/reset endpoint to reduce the speed of automated enumeration attempts, mitigating the information\u2011exposure weakness (CWE\u2011204)."], "summary": {"action": "Patch", "impact": "Account Enumeration"}, "threat_synthesis": {"affected_systems": "OpenAEV\u2011Platform\u2019s open source product openaev is affected across all releases beginning with version\u202f1.11.0 and continuing up to, but not including, version\u202f2.0.13. The patch that resolves the issue is incorporated in release\u202f2.0.13 and later builds.", "description_and_impact": "The vulnerability exists in OpenAEV\u2019s password\u2011reset API. When a client supplies an email address that exists in the system, the API responds with HTTP\u202f200; when the email does not exist, it returns HTTP\u202f400. This differential response exposes whether an account exists, which is an information\u2011exposure flaw classified as CWE\u2011204. The misuse of this flaw permits attackers to enumerate valid user accounts, potentially enabling privacy violations or targeted credential attacks, though such downstream uses are not explicitly described in the advisory.", "risk_and_exploitability": "The advisory cites a CVSS score of\u202f5.3, indicating moderate severity. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Base on the description, it is inferred that an attacker can trigger the differential responses from any network location that can reach the /api/reset endpoint without authentication, making automated enumeration straightforward. The risk is amplified if the platform is exposed to the public internet or handles sensitive user data."}}}}, "created": "2026-04-20T18:45:14.227375+00:00", "updated": "2026-04-22T11:47:54.181823+00:00", "vendors": ["openaev-platform", "openaev-platform$PRODUCT$openaev"]}