Executive brief
userSpice, an open-source PHP user management framework, contains a flaw that allows anyone on the internet to identify valid usernames registered in the system. By sending automated requests to a specific check script, an attacker can confirm which accounts exist based on the server's response. This information is often used as a first step in launching more targeted attacks, such as password guessing or phishing, which could lead to full account takeover.
Technical details
A username enumeration vulnerability exists in userSpice versions up to and including 4.3.24 due to observable response discrepancies in the existingUsernameCheck.php parser. An unauthenticated remote attacker can send POST requests containing a 'username' parameter to the /users/parsers/existingUsernameCheck.php endpoint. The application returns the string 'taken' if the username exists in the database, allowing for automated discovery of valid accounts. This flaw is classified as CWE-204 (Observable Response Discrepancy) and can be exploited via simple scripts to facilitate brute-force or credential stuffing attacks. While the vendor has been notified in the past, users should ensure they are running a version where this endpoint is properly secured or removed.
Affected products
- userSpice userSpice <= 4.3.24
Timeline
- 2018-06-10: disclosed: Initial exploit code published by Dolev Farhi
- 2026-05-23: advisory: CVE record published/updated by VulnCheck