| शीर्षक | Automad Automad CMS 2.0.0 Information Disclosure |
|---|
| विवरण | Automad CMS password reset endpoint allows unauthenticated username/email enumeration.
The endpoint:
POST /_api/user/request-password-reset-token
returns different responses depending on whether the supplied username/email exists.
For a valid account, the application returns a successful response:
{"code":200,"error":""}
For an invalid account, it returns:
{"code":200,"error":"Invalid username or email address."}
An unauthenticated attacker can abuse this behavior to determine valid usernames or email addresses registered in the application. This may assist targeted phishing attacks and credential stuffing campaigns.
The issue was reported to the vendor through GitHub issue #191 and the vendor confirmed the vulnerability and released a fix. |
|---|
| स्रोत | ⚠️ https://github.com/marcantondahmen/automad/issues/191 |
|---|
| उपयोगकर्ता | 4m3rr0r (UID 85795) |
|---|
| सबमिशन | 29/06/2026 12:10 PM (2 महीनों पहले) |
|---|
| संयम | 16/08/2026 09:19 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 391142 [automad तक 2.0.0-beta.32 Password Reset Endpoint UserController.php requestPasswordResetToken name-or-email सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|