OpenAEV-Platform openaev up to 2.0.12 Endpoint /api/reset Login response discrepancy

Summaryinfo

A vulnerability was found in OpenAEV-Platform openaev up to 2.0.12. It has been classified as problematic. The impacted element is an unknown function of the file /api/reset of the component Endpoint. This manipulation of the argument Login causes response discrepancy. This vulnerability is handled as CVE-2026-24468. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in OpenAEV-Platform openaev up to 2.0.12 and classified as problematic. Affected by this vulnerability is an unknown code block of the file /api/reset of the component Endpoint. The manipulation of the argument login with an unknown input leads to a response discrepancy vulnerability. The CWE definition for the vulnerability is CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. As an impact it is known to affect confidentiality. The summary by CVE is:

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-24468 since 01/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.0.13 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3430fe23a9244030d06fdf8e6771592e1f12ad52 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OpenAEV-Platform

Name

• openaev

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12

License

• open-source

Website

• Product: https://github.com/OpenAEV-Platform/openaev/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion