Description

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-10-12T15:17:06.073Z",
  "pubdate": "2026-10-12T15:17:06.073Z",
  "executiveSummary": "Thelia v2.6.0 is susceptible to a username enumeration vulnerability within its administrative authentication and password recovery mechanisms.\nThe application exhibits distinct behavioral responses when processing requests with invalid usernames compared to valid ones, allowing unauthenticated attackers to confirm the existence of specific administrator accounts.\nThis vulnerability is exacerbated by the absence of rate-limiting controls on these endpoints, enabling automated, high-speed enumeration at scale.\nSuccessful exploitation allows an attacker to build a database of valid administrative usernames, significantly lowering the barrier for subsequent brute-force, dictionary, or social engineering attacks.\nThe risk is considered significant for organizations relying on these accounts, as it facilitates targeted credential stuffing and unauthorized access attempts without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the authentication and password recovery logic of Thelia v2.6.0, where the application fails to normalize responses for unsuccessful login attempts or password reset requests.\nThe root cause is a lack of input validation consistency, which manifests as side-channel information leakage. Specifically, the backend server provides differentiable feedback based on whether a submitted username exists in the user database.\nIn a typical attack flow, an adversary submits a POST request to the administrative login or forgotten password endpoint. If the username does not exist, the server returns a specific error message or HTTP response code/body structure different from the response generated when a valid username is submitted with an incorrect password.\nBecause the application does not implement rate limiting or request throttling, an attacker can script the automated submission of thousands of potential usernames per minute. By monitoring the response patterns—such as variances in latency, HTTP status codes, or specific error messaging—the attacker can programmatically distinguish between invalid and valid administrative accounts.\nThe vulnerable components are the authentication controller and the password management service. Since these endpoints are exposed over the network for administrative access, they are reachable by any unauthenticated remote attacker. No specialized privileges are required to initiate these enumeration probes.\nThe post-exploitation impact is primarily directed toward intelligence gathering. By identifying valid administrative usernames, an attacker gains a critical prerequisite for launching targeted password-spraying attacks. This bypasses the uncertainty of guessing usernames, drastically increasing the probability of success for unauthorized account access. Furthermore, the ability to confirm password reset links via enumeration can be used to monitor user account status or potentially identify targets for secondary phishing campaigns."
}