# CVE-2026-25050: Vendure timing attack enables user enumeration in NativeAuthenticationStrategy

Source: https://junglewise.ai/threats/cve-2026-25050-vendure-timing-attack-enables-user-enumeration-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25050 · Severity: medium · CVSS 4 · Published 2026-01-30

Vendure is an open-source e-commerce platform that handles user authentication. A timing-based vulnerability in its login mechanism allows attackers to determine which email addresses are registered in the system by measuring response times, enabling targeted attacks like phishing campaigns and account takeover attempts without needing valid passwords.

Technologies: [@vendure/core (npm)](https://junglewise.ai/threats/technologies/vendure-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25050 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25050 being exploited in the wild.

**How severe is CVE-2026-25050?** Medium severity, with a CVSS score of 4, published 30 January 2026.

**Which products and versions are affected?** @vendure/core (npm) SEMVER:introduced=0,fixed=3.5.3.

**Is there a fix for CVE-2026-25050?** Yes. @vendure/core (npm): upgrade to 3.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25050 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25050?** Check whether you run @vendure/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @vendure/core (npm): upgrade to 3.5.3 or later

  ```sh
  npm install @vendure/core@3.5.3
  ```


## Technical details

The vulnerability is a timing attack (CWE-202: Invisible Character) in the NativeAuthenticationStrategy.authenticate() method in packages/core/src/config/auth/native-authentication-strategy.ts. When a user lookup fails, the method returns immediately (~1-5ms), but when a user exists, it performs a bcrypt password verification (~200-400ms). This 195-395ms timing differential allows unauthenticated network attackers to reliably distinguish between existing and non-existing user accounts through repeated login attempts. No authentication or user interaction is required. The fix involves performing a dummy bcrypt operation when a user is not found to equalize response times. Version 3.5.3 and later contain the patch.

## Affected products

- Vendure Core <3.5.3

## Identifiers

- CVE-2026-25050
- GHSA-6f65-4fv2-wwch

## Timeline

- 2026-01-30: disclosed
- 2026-01-30: patched: Version 3.5.3 released with fix

## References

- [https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch](https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch)

## Related threats

- [Vendure account takeover in external authentication](https://junglewise.ai/threats/cve-2026-63472-vendure-account-takeover-in-external-authentication)
- [Vendure Shop API authorization bypass via filterOperator](https://junglewise.ai/threats/cve-2026-63461-vendure-shop-api-authorization-bypass-via-filteroperator)
- [Vendure unauthenticated ReDoS in regex filter on SQLite](https://junglewise.ai/threats/cve-2026-63460-vendure-unauthenticated-redos-in-regex-filter-on-sqlite)
- [@vendure/core has a SQL Injection vulnerability](https://junglewise.ai/threats/cve-2026-40887-vendure-core-has-a-sql-injection-vulnerability)
- [Vendure insecure currencyCode handling in payment processing](https://junglewise.ai/threats/vendure-insecure-currencycode-handling-in-payment-processing-1590a2ac)