{"id":"CVE-2026-24468","summary":"OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API","details":"OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue.","aliases":["GHSA-v6rg-hf9w-f8ph"],"modified":"2026-08-12T15:31:57.564367Z","published":"2026-04-20T15:45:48.572Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-204"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24468.json"},"references":[{"type":"WEB","url":"https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120"},{"type":"WEB","url":"https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24468.json"},{"type":"ADVISORY","url":"https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24468"},{"type":"FIX","url":"https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openaev-platform/openaev","events":[{"introduced":"dae455822613dc198ab35a84028101af6963f0e7"},{"fixed":"3430fe23a9244030d06fdf8e6771592e1f12ad52"},{"fixed":"71740af4ed0ae28f83b71fd2235502f0bd4a176b"}],"database_specific":{"extracted_events":[{"introduced":"1.11.0"},{"fixed":"2.0.13"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24468.json","vanir_signatures_modified":"2026-08-12T15:31:57Z","vanir_signatures":[{"id":"CVE-2026-24468-1704c320","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java","function":"impersonateUser"},"deprecated":false,"digest":{"function_hash":"118731714162958657357727756839818581020","length":360}},{"source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java","function":"createInjectForScenario"},"deprecated":false,"digest":{"length":3052,"function_hash":"1241899034032331468906609117550100501"},"id":"CVE-2026-24468-18ba9913","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java","function":"me"},"deprecated":false,"digest":{"function_hash":"27755135592450568062156706376928189569","length":117},"id":"CVE-2026-24468-1b11ff5c"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["220418636997049011585371381517873112707","10562543787512725777096363797110617719","249756791790099966412053508543005354530","152001544139915467724044155067057413753"]},"id":"CVE-2026-24468-211d35db","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/objective/ScenarioObjectiveApi.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/objective/ExerciseObjectiveApi.java","function":"createEvaluation"},"deprecated":false,"digest":{"length":654,"function_hash":"257102493619548470385867546338064797893"},"id":"CVE-2026-24468-22ed3bc5"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/test/java/io/openbas/utils/fixtures/UserFixture.java"},"deprecated":false,"digest":{"line_hashes":["209513797376024578438921955048918023783","287246949350328184955190751706737079239","234270288025103046590580186268820544414","96313259243997916473277684245445129877","186545640864995823135792143708076171271"],"threshold":0.9},"id":"CVE-2026-24468-2dc29d9a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java","function":"updateProfile"},"deprecated":false,"digest":{"function_hash":"305788992494372943714941970170968423159","length":381},"id":"CVE-2026-24468-31ddebfe"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/PlayerApi.java","function":"players"},"deprecated":false,"digest":{"function_hash":"33319208797616975251042054824814843217","length":470},"id":"CVE-2026-24468-335ca956"},{"deprecated":false,"digest":{"function_hash":"275116976835350891488339537673347352504","length":560},"id":"CVE-2026-24468-3456570f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java","function":"checkUserAccess"}},{"deprecated":false,"digest":{"function_hash":"200602150207943072523437720350068975355","length":1568},"id":"CVE-2026-24468-3be12b21","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/document/DocumentApi.java","function":"updateDocumentInformation"}},{"digest":{"function_hash":"271806269912263012539851545459799168691","length":488},"id":"CVE-2026-24468-3e1ce8ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java","function":"createLog"},"deprecated":false},{"target":{"file":"openbas-api/src/main/java/io/openbas/service/MailingService.java"},"deprecated":false,"digest":{"line_hashes":["195214370240039868007380279151133603895","225756531302220808493786811555254639416","33879021610737174995696413860803486418","79956915923998355602486509561765167122","82247408074499894855537059964576642074"],"threshold":0.9},"id":"CVE-2026-24468-4285e559","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"},{"digest":{"line_hashes":["220418636997049011585371381517873112707","10562543787512725777096363797110617719","249756791790099966412053508543005354530","152001544139915467724044155067057413753"],"threshold":0.9},"id":"CVE-2026-24468-4b011f89","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/objective/ExerciseObjectiveApi.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"75247888360854962199004648315088816102","length":922},"id":"CVE-2026-24468-4d0aac2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/service/MailingService.java","function":"sendEmail"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java","function":"checkOrganizationAccess"},"deprecated":false,"digest":{"function_hash":"36655827237207235063171336429751994002","length":463},"id":"CVE-2026-24468-573bee5c"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/team/TeamApi.java"},"deprecated":false,"digest":{"line_hashes":["271503898886207324346532886419671918912","55486770520857008974378488982445727361","152796329024395714447574721989221403633","326027135222875151166834456090964474031"],"threshold":0.9},"id":"CVE-2026-24468-58a5ae9a"},{"id":"CVE-2026-24468-5cc7a38e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java","function":"createDryrun"},"deprecated":false,"digest":{"function_hash":"113161662345243175261525399992152934873","length":463}},{"deprecated":false,"digest":{"function_hash":"222979121417343013281797481693969022440","length":462},"id":"CVE-2026-24468-5d828fee","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java","function":"nextInjectsToExecute"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/service/InjectImportService.java","function":"importRow"},"deprecated":false,"digest":{"function_hash":"109128578078324962450888797153296049024","length":6503},"id":"CVE-2026-24468-63b5191d"},{"target":{"file":"openbas-api/src/main/java/io/openbas/rest/document/DocumentApi.java"},"deprecated":false,"digest":{"line_hashes":["7336103507171403173679842322237644313","189359648221240640914885127120082608667","72404660394420363004937300900054927189","298027402622135663808672269981229994989","265256979295194526481074868076998161230","204551015267828429807168646637992188590","157828928204001237694853659277979810842","121626184901736029450084345821119783715"],"threshold":0.9},"id":"CVE-2026-24468-65a33a40","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"},{"deprecated":false,"digest":{"line_hashes":["210289354361673741201014646669949115348","129357642099755629748396817863750534251","120157541693370649204303605194768131578","297826561551626465507113945579474063143"],"threshold":0.9},"id":"CVE-2026-24468-6c2967a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/service/AtomicTestingService.java"}},{"signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"function":"getTeams","file":"openbas-api/src/main/java/io/openbas/rest/team/TeamApi.java"},"deprecated":false,"digest":{"function_hash":"63061504929828136562100665276749479000","length":501},"id":"CVE-2026-24468-7157d1a3","signature_type":"Function"},{"target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/UserApi.java","function":"passwordReset"},"deprecated":false,"digest":{"function_hash":"109817088576123241369415150096243787633","length":1069},"id":"CVE-2026-24468-77b52274","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"},{"deprecated":false,"digest":{"line_hashes":["189413162997191766437897035294065488189","154577995164090239308480373277431133880","214367807576862836348974698907762910768","161157126763787420961754951254031316836","108742034920930628317805723881607904439","397814837417814761223512355851824299","17185176310295014257839936375408102181","321064603976316794775717347023871867230","186562358545664271064439592067288786233","26778751659090952293585540934667490246","320514594202644542075493044674786460497","126039850944375958380293827552871293666","315602064441539267476179200134396049539"],"threshold":0.9},"id":"CVE-2026-24468-7a0b7efb","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/UserApi.java"}},{"digest":{"line_hashes":["303001330592552884921069526330573798879","55486770520857008974378488982445727361","152796329024395714447574721989221403633","326027135222875151166834456090964474031"],"threshold":0.9},"id":"CVE-2026-24468-8d49dd1c","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/PlayerApi.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["335191004891199814053997595230368182126","91627788988706272177669468281962164797","255007715926285299591831365856749694074","90890759429861002830685527082616431749","288312587275251654208363012825655564719","50333432259325044824724765047251392274","52881887922403823982833091746228739002","36985685481477880918723121456915184436"],"threshold":0.9},"id":"CVE-2026-24468-995e4d60","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/service/InjectImportService.java"},"deprecated":false,"digest":{"line_hashes":["43830854011447351514184810133874679519","141005167901095497432749871262995520025","86563638940291396160726315191349488675","233065139704719197692189453035002401153"],"threshold":0.9},"id":"CVE-2026-24468-9ebc232a"},{"deprecated":false,"digest":{"line_hashes":["55536966860300410151278046399947005966","55778711680375044018131931914245248968","314984594526432419727467014842467067817","173469189671169028124905525198034175674","165187152167659462340014637765155797497","302827717939142020858000869318922372275","339010914890531796331724521203949076518","180565864265621991220344023590286492239","221984606728660217559472529548068436417","283673958033283498462537545417192389520","37756060387851320412373265231079917014","256973884174422040319505770597865421625","162103188880650732449861040598855449820","196537138192576764320747251650439136909","216415208576656409079323401691532299670","121833396242368603848201676479424382745","9810098031077103782996278627652425121"],"threshold":0.9},"id":"CVE-2026-24468-b166220f","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/test/java/io/openbas/rest/UserApiTest.java"}},{"target":{"file":"openbas-api/src/main/java/io/openbas/rest/objective/ScenarioObjectiveApi.java","function":"createEvaluation"},"deprecated":false,"digest":{"function_hash":"101719528202252572155431017050047213011","length":654},"id":"CVE-2026-24468-b1e48572","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["167264223292735504216901965071504085977","69958031325570115663750237950442692821","268360527583551156185677180908533754334","317644594767835466527745096152481214066","202923793367119747675996782624568169807","268363272491708490403307514617251092018","19548845974537797036691580117777248120","247663221990601679573225846304953332896","79463171596179283237442035017974037604","247986598977257778164439338370122013777","96830864105940306628173911232086241209","104691821150955131929974453749891262243","262966189541031205962458751812646299671","186906806854922330110746564104400259249","84224750581954927819858721537265572622","104691821150955131929974453749891262243","262966189541031205962458751812646299671","186906806854922330110746564104400259249"]},"id":"CVE-2026-24468-b228fa08","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java"}},{"source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java"},"deprecated":false,"digest":{"line_hashes":["334909572173385609921917803457834977890","221562792003221318205073149935476206101","92117295378228296831891496097245793942","139563395044375414268738846564939618453","325108471750819262224276549298200739005","87094381092105061182544626195966095484","318658043441678100509108692737277503480","113740811653556666793374885645908552404","64499014720206721102185383147289891365","251291709619826456302688995710201938013","20155825033660401536673109809540502113","284599633291032321808710712570333020095"],"threshold":0.9},"id":"CVE-2026-24468-cd9da3f7","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"217653327424913309168233766995316115577","length":1707},"id":"CVE-2026-24468-d52c0c90","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/service/AtomicTestingService.java","function":"createOrUpdate"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["157997644776284207804760460377614328926","199897818463269305862534889353496608322","87208347235283831831865048532498093537","330377069019314375143968640890373831132","239152056434010956097049023084399952176","301341221774320804697870731467574782979","328580177296315329329836134682832936263","303921844526172606689813537900709469174","318019119223863942712399255802849789831","283167409886407694125382817283492564054","66161595552485097860640617573680093769","326800481775184699085591363277257707732","131261966179525058714120707269591826410","57876046589718322722650264856916475377","247015083226000740890623291814181766616","113095888306916492662768347085062996810","4744233800750313191932191288572696227","201069491362029189670283172173057888009","54119004225830451441239877622540407825","259174931096482826169425096049245682688","85798184665701319191458608541833289535","152422121570531409660616000272665163651"],"threshold":0.9},"id":"CVE-2026-24468-d97867d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java"}},{"source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java","function":"createInjectForExercise"},"deprecated":false,"digest":{"function_hash":"292818037857105582382713067549724488114","length":3032},"id":"CVE-2026-24468-f6360e76","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"313343562535332086198593921193255150376","length":500},"id":"CVE-2026-24468-f6e19216","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java","function":"renewToken"}},{"deprecated":false,"digest":{"function_hash":"9644963055284745074939541645214821883","length":432},"id":"CVE-2026-24468-fa557197","signature_type":"Function","signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java","function":"updatePassword"}},{"signature_version":"v1","source":"https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","target":{"file":"openbas-api/src/main/java/io/openbas/rest/user/MeApi.java","function":"updateInformation"},"deprecated":false,"digest":{"length":280,"function_hash":"314339354462751593749699476516877170042"},"id":"CVE-2026-24468-fee0f18c","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}