Description

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-17T00:16:27.450Z",
  "pubdate": "2026-08-17T00:16:27.450Z",
  "executiveSummary": "An observable response discrepancy vulnerability exists in the automad application up to version 2.0.0-beta.32, specifically within the password reset endpoint. The flaw resides in the requestPasswordResetToken function handling the name-or-email argument.\nThis vulnerability allows remote attackers to determine the existence of valid user accounts within the system through differential application responses, facilitating user enumeration attacks. The risk implication involves exposing sensitive user account metadata that can be leveraged in subsequent targeted authentication attacks.\nThe attack can be initiated remotely without prior authentication, requiring network access to the target web application. According to available metrics, the attack complexity is rated as high, and the overall exploitability is considered difficult, though the exploit has been publicly disclosed and is available for malicious utilization.\nOrganizations running vulnerable instances face potential reconnaissance activities targeting user privacy and account validity. Remediation requires immediate action to neutralize the observable response discrepancy and prevent unauthorized account enumeration via the password reset mechanism.",
  "technicalDetails": "The vulnerability is rooted in the requestPasswordResetToken function located in the automad/src/server/Controllers/API/UserController.php file of the password reset component. The root cause stems from improper handling and validation of the name-or-email argument provided during the password reset request lifecycle.\nExploitation of this vulnerability occurs via observable response discrepancies. When a remote, unauthenticated attacker submits crafted input targeting the name-or-email parameter, the application returns distinct HTTP responses, error messages, or timing behaviors depending on whether the specified username or email address exists in the underlying database.\nThe step-by-step attack flow begins with the adversary identifying the password reset endpoint exposed over the network. The attacker sends a series of targeted requests containing arbitrary or known usernames and email addresses within the name-or-email argument. By analyzing the subtle variations in the server responses returned by automad/src/server/Controllers/API/UserController.php, the attacker can systematically differentiate between valid and invalid accounts.\nThe affected component is the password reset endpoint processing logic within the UserController.php controller. All automad installations up to version 2.0.0-beta.32 are susceptible to this flaw. The attack vector is strictly remote, requiring network connectivity to the web application hosting the vulnerable component.\nNo authentication or specific privileges are required to initiate the attack, as the endpoint is exposed publicly to facilitate user password recovery. The payload behavior involves iterating through user identifiers and parsing the application output to map valid system users.\nThe post-exploitation impact primarily centers on user enumeration, which provides attackers with a verified list of valid accounts. This intelligence severely undermines credential security and supports subsequent brute-force, credential stuffing, or targeted social engineering attacks against the automad platform."
}