GitHub Advisoryadvisory · Packagist

GHSA-67v7-3g49-mxh2 PrestaShop affected by time based enumeration in FO login form

MEDIUM Published 2026-02-03 Modified 2026-02-06 Official page ↗
Aliases
CVE-2026-25597
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-208
Reviewed
2026-02-03

Affected packages

• Packagist prestashop/prestashop: >= 9.0.0-alpha.1, < 9.0.3 → fixed in 9.0.3 • Packagist prestashop/prestashop: < 8.2.4 → fixed in 8.2.4

Description

Impact A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. Patches 8.2.4 and 9.0.3 Workarounds none References Found by Lam Yiu Tung

Related

Alias · CVE (1)

  • CVE-2026-25597 PrestaShop is an open source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-208 Observable Timing Discrepancy weakness

References