CVE-2026-25050

CVE-2026-25050 describes a timing attack vulnerability in Vendure, an open-source headless commerce platform, affecting versions prior to 3.5.3. This flaw in the NativeAuthenticationStrategy.authenticate() method allows attackers to enumerate valid email addresses by observing significant timing differences in authentication responses. Rated as MEDIUM severity (CVSS 5.3), the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to information disclosure (username enumeration). There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.