GHSA-724c-6vrf-99rq
Sensitive Data Exposure in loopback
Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.
Recommendation
If you're using loopback 3.x upgrade to version 3.26.0 or later.
If you're using loopback 2.x upgrade to version 2.42.0 or later.
What each source reports
GitHub AdvisoriesNo score
Sensitive Data Exposure in loopback
Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.
Recommendation
If you're using loopback 3.x upgrade to version 3.26.0 or later.
If you're using loopback 2.x upgrade to version 2.42.0 or later.
- Record
GHSA-724c-6vrf-99rq- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVCLSA-2026-1776818203No score
TuxCare security update for loopback (1 CVE)
TuxCare rebuilt loopback to address 1 CVE. Fixed in 1.10.0-tuxcare.2.
- Record
CLSA-2026-1776818203- Updated
- 2026-11-02
OSVNo score
Sensitive Data Exposure in loopback
Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.
Recommendation
If you're using loopback 3.x upgrade to version 3.26.0 or later.
If you're using loopback 2.x upgrade to version 2.42.0 or later.
- Record
GHSA-724c-6vrf-99rq- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-724c-6vrf-99rq is a vulnerability with no CVSS score yet in loopback, published September 2, 2020. No source lists public exploit code. Fixed in loopback 2.42.0.