https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:26:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73306 <p>Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.</p> <p>Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73306 https://db.gcve.eu/vuln/ghsa-cr7p-cr3q-h5cm <p><strong>Affected:</strong> npm: @budibase/server</p> <p>## Summary</p> <p>The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user&#39;s account is locked after 5 failed login attempts, the server returns a distinct `403` response with `X-Account-Locked: 1` and `Retry-After: 900` headers plus the message &#34;Account temporarily locked.&#34; For non-existing users, the response is always a generic `403 &#34;Unauthorized&#34;` regardless of attempt count, because the lockout counter is never incremented.</p> <p>## Details</p> <p>The vulnerability exists in two files that implement the login lockout feature:</p> <p>**`packages/worker/src/middleware/lockout.ts:18-36`** — The lockout middleware only blocks requests for users that exist in the database AND are locked:</p> <p>```typescript export default async (ctx: Ctx, next: Next) =&gt; { const email = ctx.request.body.username if (!email) { return await next() } const dbUser = await userSdk.db.getUserByEmail(email) if (dbUser &amp;&amp; (await isLocked(email))) { // line 26: non-existing users skip this entirely ctx.set(&#34;X-Account-Locked&#34;, &#34;1&#34;) ctx.set(&#34;Retry-After&#34;, String(env.LOGIN_LOCKOUT_SECONDS)) ctx.throw(403, &#34;Account temporarily locked. Try again later.&#34;) } return await next() } ```</p> <p>**`packages/worker/src/api/controllers/global/auth.ts:127-141`** — The login handler only increments the failure counter for existing users:</p> <p>```typescript if (err || !user) { if (dbUser) { //…</p> <p><strong>Affected:</strong> npm: @budibase/server</p> <p>## Summary</p> <p>The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user&#39;s account is locked after 5 failed login attempts, the server returns a distinct `403` response with `X-Account-Locked: 1` and `Retry-After: 900` headers plus the message &#34;Account temporarily locked.&#34; For non-existing users, the response is always a generic `403 &#34;Unauthorized&#34;` regardless of attempt count, because the lockout counter is never incremented.</p> <p>## Details</p> <p>The vulnerability exists in two files that implement the login lockout feature:</p> <p>**`packages/worker/src/middleware/lockout.ts:18-36`** — The lockout middleware only blocks requests for users that exist in the database AND are locked:</p> <p>```typescript export default async (ctx: Ctx, next: Next) =&gt; { const email = ctx.request.body.username if (!email) { return await next() } const dbUser = await userSdk.db.getUserByEmail(email) if (dbUser &amp;&amp; (await isLocked(email))) { // line 26: non-existing users skip this entirely ctx.set(&#34;X-Account-Locked&#34;, &#34;1&#34;) ctx.set(&#34;Retry-After&#34;, String(env.LOGIN_LOCKOUT_SECONDS)) ctx.throw(403, &#34;Account temporarily locked. Try again later.&#34;) } return await next() } ```</p> <p>**`packages/worker/src/api/controllers/global/auth.ts:127-141`** — The login handler only increments the failure counter for existing users:</p> <p>```typescript if (err || !user) { if (dbUser) { //…</p> https://db.gcve.eu/vuln/ghsa-cr7p-cr3q-h5cm