{"id":"GHSA-2frx-j9hj-6c65","summary":"User enumeration in authentication mechanisms","details":"Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.","modified":"2024-12-02T05:54:53.242476Z","published":"2021-05-17T20:52:21Z","database_specific":{"github_reviewed_at":"2021-05-17T19:20:17Z","nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/lexik/LexikJWTAuthenticationBundle/security/advisories/GHSA-2frx-j9hj-6c65"},{"type":"WEB","url":"https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7"},{"type":"WEB","url":"https://github.com/lexik/LexikJWTAuthenticationBundle"}],"affected":[{"package":{"name":"lexik/jwt-authentication-bundle","ecosystem":"Packagist","purl":"pkg:composer/lexik/jwt-authentication-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.7"}]}],"versions":["1.6.0","v1.0.0","v1.0.1","v1.0.10","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.5.0","v1.5.1","v1.7.0","v1.7.1","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.10.6","v2.2.0","v2.3.0","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.7.0","v2.8.0","v2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-2frx-j9hj-6c65/GHSA-2frx-j9hj-6c65.json"}},{"package":{"name":"lexik/jwt-authentication-bundle","ecosystem":"Packagist","purl":"pkg:composer/lexik/jwt-authentication-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}],"versions":["v2.11.0","v2.11.1","v2.11.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-2frx-j9hj-6c65/GHSA-2frx-j9hj-6c65.json"}}],"schema_version":"1.9.0"}