# CVE-2022-39228: vantage6 username enumeration via account lockout discrepancy

Source: https://junglewise.ai/threats/cve-2022-39228-vantage6-username-enumeration-via-account-lockout-discrepancy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-28. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2022-39228 · Severity: medium · CVSS 6.5 · Published 2023-02-28

vantage6 is an open-source framework for privacy-preserving federated learning. A vulnerability in its login system allows unauthorized users to determine if a specific username exists on the platform. By repeatedly attempting to log in with a potential username, an attacker can observe if the account becomes temporarily blocked, confirming the username's validity and potentially facilitating targeted credential-stuffing attacks.

Technologies: [vantage6 (PyPI)](https://junglewise.ai/threats/technologies/vantage6). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-39228 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-39228 being exploited in the wild.

**How severe is CVE-2022-39228?** Medium severity, with a CVSS score of 6.5, published 28 February 2023.

**Which products and versions are affected?** vantage6 (PyPI) < 3.8.0, ECOSYSTEM:introduced=0,fixed=3.8.0, ECOSYSTEM:introduced=3.3.3,fixed=3.8.0, GIT:introduced=0,fixed=ab4381c35d24add06f75d5a8a284321f7a340bd2|ECOSYSTEM:introduced=3.3.3,fixed=3.8.0.

**Is there a fix for CVE-2022-39228?** Yes. vantage6 (PyPI): upgrade to 3.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-39228 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-39228?** Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6 (PyPI): upgrade to 3.8.0 or later

  ```sh
  pip install "vantage6>=3.8.0"
  ```


## Technical details

The vulnerability is classified as an Observable Response Discrepancy (CWE-204). While the application correctly returns generic error messages for failed login attempts to prevent simple enumeration, it implements a temporary account lockout policy after a specific number of failed attempts. An attacker can exploit this by submitting multiple failed login requests for a target username; if the account exists, it will eventually be blocked, creating a detectable change in system behavior or response timing compared to non-existent accounts. This allows for automated username harvesting via the network without prior authentication. The issue is resolved in version 3.8.0.

## Affected products

- vantage6 vantage6 < 3.8.0

## Identifiers

- CVE-2022-39228
- GHSA-36gx-9q6h-g429
- PYSEC-2023-313
- PYSEC-2023-52

## Timeline

- 2022-09-13: disclosed: CVE-2022-39228 assigned
- 2023-02-28: patched: Fix merged in version 3.8.0
- 2023-02-28: advisory

## References

- [https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429](https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429)
- [https://github.com/vantage6/vantage6/issues/59](https://github.com/vantage6/vantage6/issues/59)
- [https://github.com/vantage6/vantage6/pull/281](https://github.com/vantage6/vantage6/pull/281)
- [https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2](https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2)
- [https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml)

## Related threats

- [PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review](https://junglewise.ai/threats/cve-2026-73652-vantage6-algorithm-developer-can-edit-another-developer-s)
- [PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration](https://junglewise.ai/threats/cve-2024-32969-vantage6-collaboration-admins-can-extend-their-influence-by)
- [PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token](https://junglewise.ai/threats/cve-2024-24770-vantage6-vulnerable-to-a-username-timing-attack-on-recover)
- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)