WWBN AVideo versions 29.0 and earlier contain a vulnerability in the objects/mention.json.php endpoint that allows unauthenticated user enumeration. The endpoint lacks proper authentication checks such as User::loginCheck() or admin gate, relying only on a weak entry guard that matches a request parameter. This flaw enables attackers to enumerate users without authentication. The vulnerability is assigned CVE-2026-45620 with a medium severity and a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor.
Statamic CMS versions prior to 5.73.21 and 6.15.0 have a vulnerability in their forgot password forms that allows unauthenticated attackers to determine if an email address is associated with an account. This user enumeration vulnerability can facilitate further credential-based attacks. The issue is fixed in versions 5.73.21 and 6.15.
CVE-2024-0391 is a medium severity vulnerability in WSO2 Identity Server versions 5.10.0 through 7.0.0. It involves an observable response discrepancy in the email OTP flow's user account lock state check, which fails to properly validate user input. This flaw allows an attacker to determine whether specific usernames are registered in the system. Such information disclosure can facilitate brute-force and social engineering attacks, increasing risks to user data and organizational security.
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue.
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.
CVE-2026-34264 is a vulnerability in SAP Human Capital Management for SAP S/4HANA where authorization checks return specific messages that allow an authenticated user with low privileges to infer and enumerate information beyond their authorized scope. This results in the disclosure of sensitive information, impacting confidentiality. Integrity and availability are not affected. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVE-2026-33323 is a medium-severity vulnerability in parse-community's parse-server prior to versions 8.6.51 and 9.6.0-alpha.40. The issue involves observable response discrepancies in the Pages and legacy PublicAPI routes used for resending email verification links. An unauthenticated attacker can enumerate valid usernames by analyzing different redirect responses depending on whether a username exists and has an unverified email. This vulnerability arises because the emailVerifySuccessOnInvalidEmail configuration, which mitigates enumeration, did not apply to these routes. The flaw allows information disclosure without requiring authentication or user interaction.
CVE-2026-33688 is a medium severity vulnerability in WWBN AVideo versions up to 26.0 that allows unauthenticated attackers to enumerate valid usernames and account statuses via the password recovery endpoint. The flaw arises because the endpoint performs user existence and account status checks before captcha validation, returning distinct JSON error messages for valid, inactive, or banned accounts. This observable response discrepancy enables attackers to harvest user information at scale without solving captchas. While no known exploits are reported in the wild, this information disclosure can facilitate targeted attacks such as phishing or brute force. A patch addressing this issue has been committed but not linked here. Organizations using affected versions should apply the patch promptly and consider additional mitigations to limit user enumeration risks.
Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36.
Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.
The vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application. This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true). This vulnerability is fixed in 8.6.34 and 9.6.0.
CVE-2026-31888 is a medium-severity vulnerability in Shopware core versions prior to 6.7.8.1 and 6.6.10.15. It arises from an observable response discrepancy in the Store API login endpoint, which returns different error codes and messages depending on whether an email address is registered or not. This behavior allows unauthenticated attackers to enumerate valid customer accounts by probing email addresses. The storefront login controller does not exhibit this flaw, indicating inconsistent error handling between components.
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
CVE-2026-25509 is a medium severity vulnerability in the ci4ms CMS based on CodeIgniter 4, allowing unauthenticated attackers to enumerate registered email addresses via observable response discrepancies during the password reset process. This email enumeration flaw can aid attackers in identifying valid user accounts, facilitating targeted phishing or brute-force attacks. The vulnerability affects ci4ms versions prior to 0.28.5.0 and has been patched in that release. Exploitation requires no authentication or user interaction and can be performed remotely over the network. While it does not directly impact system integrity or availability, the confidentiality of user registration data is compromised. European organizations using ci4ms should upgrade promptly to mitigate this risk. Countries with higher adoption of CodeIgniter-based CMS solutions and significant enterprise or government use of ci4ms are more likely to be affected.
CVE-2026-24664 is a medium severity username enumeration vulnerability in the Open eClass platform (formerly GUnet eClass) versions prior to 4.2. It allows unauthenticated attackers to identify valid usernames by analyzing observable differences in login response behavior. This vulnerability does not impact confidentiality beyond username disclosure, nor does it affect integrity or availability. Exploitation requires no authentication or user interaction and can be performed remotely over the network. The issue has been patched in version 4.2. European organizations using affected versions should update promptly to prevent potential reconnaissance activities that could facilitate further attacks. Countries with significant adoption of Open eClass in educational institutions are most at risk. Mitigation involves upgrading to version 4.