CVE-2026-24468 json
OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API
published 2026-04-20 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-23883
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue.
Patch / fix
- io.openaev openaev-platform 2.0.13
- openaev openaev 2.0.13
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- OpenAEV-Platform openaev
Classification
- Weakness
-
- CWE-204 Observable Response Discrepancy
References
- github.com /OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52
- github.com /OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph
- github.com /OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/r
- github.com /OpenAEV-Platform/openaev/releases/tag/2.0.13
Sources
- CVE List CVE-2026-24468
- NVD CVE-2026-24468
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.