tag

Brute-Force-Enabler

Vendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)

CVE-2026-25050· Vendure (NativeAuthenticationStrategy.authenticate(), Admin GraphQL API) unpatched