CVE-2026-11960 in FacturaScripts
Summary
by MITRE • 10/20/2026
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in FacturaScripts version 2025.61 represents a classic information disclosure flaw that facilitates user enumeration through differential response analysis. This security weakness stems from inconsistent application behavior when processing authentication requests with valid versus invalid usernames. Instead of returning uniform error responses for all failed login attempts, the system exhibits measurable variations based on whether the provided username corresponds to an existing account in the database. These discrepancies can manifest as differences in HTTP status codes, distinct textual error messages, or subtle but detectable changes in response latency. Such behavioral inconsistencies provide a reliable signal that allows external actors to distinguish between legitimate and non-existent user identities without possessing valid credentials.
From a technical perspective, this flaw aligns with CWE-204, which describes the observable response difference for an input condition, and is closely related to CWE-284 regarding improper access control during authentication processes. The vulnerability enables what is known as an enumeration attack, where an adversary systematically probes the application by submitting various usernames and analyzing the server's reaction. In many web applications, developers inadvertently create these side channels by checking if a username exists before validating its password, or by using different database queries that result in varying execution times for existing versus non-existing records. This lack of uniformity violates fundamental security principles regarding consistent error handling and provides attackers with a low-effort method to map the application's user base.
The operational impact of this vulnerability is significant as it serves as a critical enabler for subsequent, more destructive attacks. By successfully enumerating valid usernames, an attacker can compile a targeted list of accounts that are known to exist within the system. This information drastically reduces the search space for brute-force and password spraying campaigns, allowing attackers to focus their resources exclusively on active accounts rather than wasting time on invalid ones. Furthermore, knowledge of specific user identities facilitates highly personalized social engineering attacks, such as spear-phishing or pretexting, where the attacker leverages real names and roles to increase the likelihood of credential compromise. In environments using password spraying techniques, this enumeration ensures that failed attempts are not attributed to non-existent users, thereby increasing the stealth and success rate of the attack while potentially avoiding account lockout mechanisms designed for brute-force protection.
This activity is categorized under MITRE ATT&CK technique T1087, Account Discovery, specifically within the context of cloud or application environments where user enumeration precedes credential access attempts like T1110, Brute Force. The exploitation does not require complex tooling and can be performed using simple automated scripts that iterate through common usernames while monitoring response metrics. This makes it a persistent threat for applications exposed to the internet with weak authentication implementations.
Mitigation strategies must focus on eliminating these differential signals entirely. Developers should ensure that all login failures, regardless of whether the username is valid or invalid and whether the password is correct or incorrect, return identical HTTP status codes, generic error messages, and similar response times. Implementing a uniform delay mechanism can also help mask timing differences caused by database lookups for non-existent users. Additionally, enforcing account lockout policies after multiple failed attempts from a single source IP address can mitigate the effectiveness of automated enumeration scripts. Regular security testing using specialized vulnerability scanners that detect user enumeration flaws is recommended to identify and remediate such inconsistencies before they are exploited in production environments.