CVE-2026-24468 | OpenAEV-Platform openaev up to 2.0.12 Endpoint /api/reset Login response discrepancy (GHSA-v6rg-hf9w-f8ph)

VDB-358321 · CVE-2026-24468 · GHSA-V6RG-HF9W-F8PH OPENAEV-PLATFORM OPENAEV UP TO 2.0.12 ENDPOINT /API/RESET LOGIN RESPONSE DISCREPANCY HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.2 $0-$5k 2.41+ Summaryinfo A vulnerability was found in OpenAEV-Platform openaev up to 2.0.12. It has been classified as problematic. The impacted element is an unknown function of the file /api/reset of the component Endpoint. This manipulation of the argument Login causes response discrepancy. This vulnerability is handled as CVE-2026-24468. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended. Detailsinfo A vulnerability has been found in OpenAEV-Platform openaev up to 2.0.12 and classified as problematic. Affected by this vulnerability is an unknown code block of the file /api/reset of the component Endpoint. The manipulation of the argument login with an unknown input leads to a response discrepancy vulnerability. The CWE definition for the vulnerability is CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. As an impact it is known to affect confidentiality. The summary by CVE is: OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue. The advisory is shared at github.com. This vulnerability is known as CVE-2026-24468 since 01/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue. Upgrading to version 2.0.13 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3430fe23a9244030d06fdf8e6771592e1f12ad52 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Vendor OpenAEV-Platform Name openaev Version 2.0.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 2.0.8 2.0.9 2.0.10 2.0.11 2.0.12 License open-source Website Product: https://github.com/OpenAEV-Platform/openaev/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.3 VulDB Meta Temp Score: 5.2 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 5.3 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Response discrepancy CWE: CWE-204 / CWE-203 / CWE-200 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: openaev 2.0.13 Patch: 3430fe23a9244030d06fdf8e6771592e1f12ad52 Timelineinfo 01/23/2026 CVE reserved 04/20/2026 +86 days Advisory disclosed 04/20/2026 +0 days VulDB entry created 04/20/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-v6rg-hf9w-f8ph Status: Confirmed CVE: CVE-2026-24468 (🔒) GCVE (CVE): GCVE-0-2026-24468 GCVE (VulDB): GCVE-100-358321 Entryinfo Created: 04/20/2026 19:49 Changes: 04/20/2026 19:49 (69) Complete: 🔍 Cache ID: 99:C36:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸