Account Enumeration Vulnerability in OpenAEV by OpenAEV Platform

CVE-2026-24468

What is CVE-2026-24468?

The OpenAEV platform contains a flaw in its /api/reset endpoint that allows attackers to identify registered email addresses based on inconsistent server responses. When a non-existent email is provided, the server returns a 400 Bad Request error, while a valid email generates a 200 OK response. This discrepancy enables attackers to automate requests with possible email addresses and confirm their existence without needing any form of authentication. To mitigate this vulnerability, the endpoint should standardize its responses, thereby preventing unauthorized disclosure of account information. The issue was resolved in version 2.0.13.

References