Timing Attack Vulnerability in Vendure Open-Source Commerce Platform
CVE-2026-25050
Key Information:
Badges
What is CVE-2026-25050?
The Vendure open-source headless commerce platform has a vulnerability in the NativeAuthenticationStrategy.authenticate() method, which is susceptible to timing attacks. This flaw allows malicious actors to differentiate between valid and invalid usernames by exploiting the timing discrepancies in response times. Specifically, the method provides a quicker response for non-existing accounts (approx. 1-5 ms) compared to existing accounts with bcrypt authentication (around 200-400 ms). This enables attackers to systematically determine valid usernames based on the timing variations. The issue was addressed in version 3.5.3.
Affected Version(s)
vendure < 3.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.