CVE-2026-25050
Description
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.
How to fix
- vendure vendure3.5.3 or later
- @vendure/core3.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vendure vendure | v < 3.5.3 | 3.5.3 |
| @vendure/corenpm | v < 3.5.3 | 3.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.