Executive brief
Vendure is an open-source e-commerce platform that handles user authentication. A timing-based vulnerability in its login mechanism allows attackers to determine which email addresses are registered in the system by measuring response times, enabling targeted attacks like phishing campaigns and account takeover attempts without needing valid passwords.
Technical details
The vulnerability is a timing attack (CWE-202: Invisible Character) in the NativeAuthenticationStrategy.authenticate() method in packages/core/src/config/auth/native-authentication-strategy.ts. When a user lookup fails, the method returns immediately (~1-5ms), but when a user exists, it performs a bcrypt password verification (~200-400ms). This 195-395ms timing differential allows unauthenticated network attackers to reliably distinguish between existing and non-existing user accounts through repeated login attempts. No authentication or user interaction is required. The fix involves performing a dummy bcrypt operation when a user is not found to equalize response times. Version 3.5.3 and later contain the patch.
Affected products
- Vendure Core <3.5.3
Timeline
- 2026-01-30: disclosed
- 2026-01-30: patched: Version 3.5.3 released with fix