Skip to content
OpenAdvisories

Vendor

vendurehq

7 known vulnerabilities.

Products

vendure 7
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm