Executive brief
REDCap, a secure web application for building and managing online databases and surveys, is vulnerable to a flaw that allows unauthorized individuals to identify valid usernames. By observing differences in how the system responds to login attempts, an attacker can confirm which usernames exist on the platform. This information can be used to facilitate more targeted password-guessing attacks or social engineering attempts against specific users.
Technical details
REDCap 14.3.13 is vulnerable to username enumeration (CWE-203) during the authentication process. The application returns distinct error messages or exhibits observable behavioral differences depending on whether a submitted username exists in the database. While the application includes some protection mechanisms to mitigate brute-force attacks, the implementation of these mechanisms itself reveals whether a user is valid. An unauthenticated remote attacker can exploit this by sending multiple HTTP authentication requests to map out valid user accounts, which can then be used as a precursor to credential stuffing or brute-force attacks.
Affected products
- Vanderbilt University REDCap 14.3.13
Timeline
- 2026-01-02: disclosed: Initial CVE publication
- 2026-01-02: advisory: Third-party advisory published on GitHub