Vulnerability in Lemmy Login Endpoint Exposes Usernames for Attackers
CVE-2026-54739
6.9MEDIUM
What is CVE-2026-54739?
An issue exists in Lemmy prior to 0.19.19 and 1.0.0-beta.1 where the login endpoint exposes the existence of usernames or emails based on the error responses provided. Specifically, a non-existent account generates a 404 error, while an incorrect password for an existing account results in a 400 error. This inconsistency allows attackers to identify registered usernames or email addresses, potentially leading to targeted credential exploitation or social engineering attacks. Users are encouraged to upgrade to the patched versions to mitigate this risk.
Affected Version(s)
lemmy < 0.19.19 < 0.19.19
lemmy >= 1.0.0-alpha.0, < 1.0.0-beta.1 < 1.0.0-alpha.0, 1.0.0-beta.1