{"id":"CVE-2026-25138","aliases":["EUVD-2026-8712","GHSA-38wq-6q2w-hcf9","PYSEC-2026-3053"],"status":"published","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00375,"percentile":0.31938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-204"],"published":"2026-02-25T18:53:42Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"PyPI","package":"rucio-webui","fixed_in":["35.8.3","38.5.4","39.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"35.8.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"36.0.0rc1"},{"fixed":"38.5.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"39.0.0rc1"},{"fixed":"39.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"35.8.3"}]}],"versions":["1.10.0","1.10.0.post1","1.10.2","1.10.3","1.10.4","1.10.4.post1","1.10.5","1.10.6","1.11.0","1.11.0.post1","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.0.post1","1.12.1","1.12.2","1.12.2.post1","1.12.3","1.12.3.post1","1.12.4","1.12.5","1.12.5.post1","1.12.5.post2","1.12.6","1.13.0","1.13.0.post1","1.13.0.post2","1.13.1","1.13.2","1.14.0.post1","1.14.0.post2","1.14.1.post1","1.14.2","1.14.6","1.14.7","1.14.8","1.14.8.post1","1.14.8.post2","1.14.9","1.14.9.post1","1.15.0","1.15.0.post1","1.15.1","1.15.2","1.15.3","1.15.3.post1","1.15.4","1.15.4.post1","1.16.0","1.16.0.post1","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.17.2.post1","1.17.5","1.17.6","1.17.6.post1","1.17.6.post2","1.17.7","1.17.8","1.17.8.post1","1.17.8.post2","1.18.0","1.18.1","1.18.3","1.18.4","1.18.5","1.18.5.post1","1.18.6","1.18.6.post1","1.18.7","1.18.8","1.18.8.post1","1.18.9","1.19.0.post2","1.19.1","1.19.2","1.19.3","1.19.4","1.19.4.post1","1.19.4.post2","1.19.5","1.19.6","1.19.7","1.19.7.post1","1.19.8","1.20.0","1.20.0rc1","1.20.1","1.20.1.post1","1.20.10","1.20.11","1.20.13","1.20.14","1.20.15","1.20.16","1.20.2","1.20.3","1.20.3rc1","1.20.3rc2","1.20.4","1.20.4.post1","1.20.4.post2","1.20.4rc1","1.20.4rc2","1.20.4rc3","1.20.5","1.20.6","1.20.7","1.20.8","1.20.9","1.21.0","1.21.0.dev1","1.21.0.post1","1.21.0.post2","1.21.0rc1","1.21.0rc2","1.21.0rc3","1.21.1","1.21.10","1.21.10.post1","1.21.12","1.21.2","1.21.3","1.21.4","1.21.5","1.21.6","1.21.7","1.21.8","1.22.0","1.22.0.dev1","1.22.0.dev2","1.22.0.dev3","1.22.0rc1","1.22.0rc2","1.22.1","1.22.2","1.22.3","1.22.3.post1","1.22.4","1.22.4.dev1","1.22.6","1.22.6.post1","1.22.7","1.22.8","1.22.8.post1","1.23.0","1.23.0rc1","1.23.0rc2","1.23.1","1.23.10","1.23.11","1.23.11.post1","1.23.11.post2","1.23.11.post3","1.23.11.post4","1.23.12","1.23.13","1.23.14","1.23.15","1.23.17","1.23.18","1.23.19","1.23.2","1.23.2.post1","1.23.2.post2","1.23.20","1.23.4","1.23.5","1.23.5.post1","1.23.6","1.23.6.post1","1.23.7","1.23.7.post1","1.23.8","1.23.9","1.23.9.post1","1.23.9.post2","1.23.9.post3","1.23.9.post4","1.24.0","1.24.0rc1","1.24.1","1.24.1.post1","1.24.1.post2","1.24.1.post3","1.24.1.post4","1.24.2","1.24.2.post1","1.24.3","1.24.3.post1","1.24.4","1.24.5","1.24.5.post1","1.25.0","1.25.0rc1","1.25.0rc2","1.25.1","1.25.1.post1","1.25.2","1.25.3","1.25.3.post1","1.25.3.post2","1.25.4","1.25.4.post1","1.25.5","1.25.6","1.25.7","1.26.0","1.26.0rc1","1.26.0rc2","1.26.1","1.26.1.post1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.2","1.26.4","1.26.5","1.26.6","1.26.7","1.26.7.post1","1.26.8","1.26.8.post1","1.26.9","1.27.0","1.27.0.post1","1.27.0rc1","1.27.0rc2","1.27.1","1.27.10","1.27.11","1.27.12","1.27.2","1.27.3","1.27.4","1.27.4.post1","1.27.5","1.27.7","1.27.9","1.28.0","1.28.0rc1","1.28.0rc2","1.28.1","1.28.2","1.28.3","1.28.4","1.28.5","1.28.6","1.28.7","1.29.0","1.29.0rc1","1.29.0rc2","1.29.1","1.29.10","1.29.11","1.29.12","1.29.13","1.29.14","1.29.15","1.29.16","1.29.17","1.29.18","1.29.19","1.29.2","1.29.2.post1","1.29.2.post2","1.29.3","1.29.3.post1","1.29.4","1.29.5","1.29.6","1.29.7","1.29.7.post1","1.29.8","1.29.9","1.30.0","1.30.0rc1","1.30.0rc2","1.30.0rc3","1.30.1","1.30.2","1.30.3","1.30.4","1.30.5","1.30.6","1.30.7","1.30.8","1.31.0","1.31.0rc1","1.31.0rc2","1.31.0rc3","1.31.1","1.31.2","1.31.3","1.31.4","1.31.5","1.31.6","1.31.7","1.5.10","1.5.11","1.5.11.post1","1.5.11.post2","1.5.12","1.6.0","1.6.0.post1","1.6.0.post2","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.7","1.6.8","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.5.post1","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","32.0.0","32.0.0rc1","32.0.0rc2","32.1.0","32.2.0","32.3.0","32.3.1","32.4.0","32.5.0","32.5.0.post1","32.5.1","32.6.0","32.6.0.post1","32.7.0","32.8.0","32.8.1","32.8.2","32.8.3","32.8.4","32.8.5","32.8.6","33.0.0","33.0.0rc1","33.0.0rc2","33.0.0rc3","33.1.0","33.2.0","33.2.1","33.3.0","33.4.0","33.4.0.post1","33.5.0","33.6.0","33.6.1","34.0.0","34.0.0rc1","34.0.0rc2","34.1.0","34.2.0","34.3.0","34.4.0","34.4.1","34.4.2","34.4.3","34.5.0","34.6.0","35.0.0","35.0.0rc1","35.0.0rc2","35.0.1","35.1.0","35.1.1","35.2.0","35.2.1","35.3.0","35.4.0","35.4.1","35.5.0","35.6.0","35.6.1","35.7.0","35.8.0","35.8.1","35.8.2"]},{"source":"osv","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"36.0.0rc1"},{"fixed":"38.5.4"}]}],"versions":["36.0.0","36.0.0.post1","36.0.0.post2","36.0.0rc1","36.0.0rc2","36.0.0rc3","36.0.0rc4","36.0.0rc5","36.1.0","36.2.0","36.3.0","36.4.0","36.5.0","37.0.0","37.0.0rc1","37.0.0rc2","37.0.0rc3","37.0.0rc4","37.1.0","37.1.0.post1","37.2.0","37.3.0","37.4.0","37.5.0","37.6.0","37.7.0","37.7.1","38.0.0","38.0.0rc1","38.0.0rc2","38.0.0rc3","38.1.0","38.2.0","38.3.0","38.4.0","38.5.0","38.5.1","38.5.2","38.5.3"]},{"source":"osv","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"39.0.0rc1"},{"fixed":"39.3.1"}]}],"versions":["39.0.0","39.0.0rc1","39.0.0rc2","39.1.0","39.2.0","39.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"35.8.3"},{"introduced":"36.0.0rc1"},{"fixed":"38.5.4"},{"introduced":"39.0.0rc1"},{"fixed":"39.3.1"}]}],"versions":["1.10.0","1.10.0.post1","1.10.2","1.10.3","1.10.4","1.10.4.post1","1.10.5","1.10.6","1.11.0","1.11.0.post1","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.0.post1","1.12.1","1.12.2","1.12.2.post1","1.12.3","1.12.3.post1","1.12.4","1.12.5","1.12.5.post1","1.12.5.post2","1.12.6","1.13.0","1.13.0.post1","1.13.0.post2","1.13.1","1.13.2","1.14.0.post1","1.14.0.post2","1.14.1.post1","1.14.2","1.14.6","1.14.7","1.14.8","1.14.8.post1","1.14.8.post2","1.14.9","1.14.9.post1","1.15.0","1.15.0.post1","1.15.1","1.15.2","1.15.3","1.15.3.post1","1.15.4","1.15.4.post1","1.16.0","1.16.0.post1","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.17.2.post1","1.17.5","1.17.6","1.17.6.post1","1.17.6.post2","1.17.7","1.17.8","1.17.8.post1","1.17.8.post2","1.18.0","1.18.1","1.18.3","1.18.4","1.18.5","1.18.5.post1","1.18.6","1.18.6.post1","1.18.7","1.18.8","1.18.8.post1","1.18.9","1.19.0.post2","1.19.1","1.19.2","1.19.3","1.19.4","1.19.4.post1","1.19.4.post2","1.19.5","1.19.6","1.19.7","1.19.7.post1","1.19.8","1.20.0","1.20.0rc1","1.20.1","1.20.1.post1","1.20.10","1.20.11","1.20.13","1.20.14","1.20.15","1.20.16","1.20.2","1.20.3","1.20.3rc1","1.20.3rc2","1.20.4","1.20.4.post1","1.20.4.post2","1.20.4rc1","1.20.4rc2","1.20.4rc3","1.20.5","1.20.6","1.20.7","1.20.8","1.20.9","1.21.0","1.21.0.dev1","1.21.0.post1","1.21.0.post2","1.21.0rc1","1.21.0rc2","1.21.0rc3","1.21.1","1.21.10","1.21.10.post1","1.21.12","1.21.2","1.21.3","1.21.4","1.21.5","1.21.6","1.21.7","1.21.8","1.22.0","1.22.0.dev1","1.22.0.dev2","1.22.0.dev3","1.22.0rc1","1.22.0rc2","1.22.1","1.22.2","1.22.3","1.22.3.post1","1.22.4","1.22.4.dev1","1.22.6","1.22.6.post1","1.22.7","1.22.8","1.22.8.post1","1.23.0","1.23.0rc1","1.23.0rc2","1.23.1","1.23.10","1.23.11","1.23.11.post1","1.23.11.post2","1.23.11.post3","1.23.11.post4","1.23.12","1.23.13","1.23.14","1.23.15","1.23.17","1.23.18","1.23.19","1.23.2","1.23.2.post1","1.23.2.post2","1.23.20","1.23.4","1.23.5","1.23.5.post1","1.23.6","1.23.6.post1","1.23.7","1.23.7.post1","1.23.8","1.23.9","1.23.9.post1","1.23.9.post2","1.23.9.post3","1.23.9.post4","1.24.0","1.24.0rc1","1.24.1","1.24.1.post1","1.24.1.post2","1.24.1.post3","1.24.1.post4","1.24.2","1.24.2.post1","1.24.3","1.24.3.post1","1.24.4","1.24.5","1.24.5.post1","1.25.0","1.25.0rc1","1.25.0rc2","1.25.1","1.25.1.post1","1.25.2","1.25.3","1.25.3.post1","1.25.3.post2","1.25.4","1.25.4.post1","1.25.5","1.25.6","1.25.7","1.26.0","1.26.0rc1","1.26.0rc2","1.26.1","1.26.1.post1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.2","1.26.4","1.26.5","1.26.6","1.26.7","1.26.7.post1","1.26.8","1.26.8.post1","1.26.9","1.27.0","1.27.0.post1","1.27.0rc1","1.27.0rc2","1.27.1","1.27.10","1.27.11","1.27.12","1.27.2","1.27.3","1.27.4","1.27.4.post1","1.27.5","1.27.7","1.27.9","1.28.0","1.28.0rc1","1.28.0rc2","1.28.1","1.28.2","1.28.3","1.28.4","1.28.5","1.28.6","1.28.7","1.29.0","1.29.0rc1","1.29.0rc2","1.29.1","1.29.10","1.29.11","1.29.12","1.29.13","1.29.14","1.29.15","1.29.16","1.29.17","1.29.18","1.29.19","1.29.2","1.29.2.post1","1.29.2.post2","1.29.3","1.29.3.post1","1.29.4","1.29.5","1.29.6","1.29.7","1.29.7.post1","1.29.8","1.29.9","1.30.0","1.30.0rc1","1.30.0rc2","1.30.0rc3","1.30.1","1.30.2","1.30.3","1.30.4","1.30.5","1.30.6","1.30.7","1.30.8","1.31.0","1.31.0rc1","1.31.0rc2","1.31.0rc3","1.31.1","1.31.2","1.31.3","1.31.4","1.31.5","1.31.6","1.31.7","1.5.10","1.5.11","1.5.11.post1","1.5.11.post2","1.5.12","1.6.0","1.6.0.post1","1.6.0.post2","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.7","1.6.8","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.5.post1","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","32.0.0","32.0.0rc1","32.0.0rc2","32.1.0","32.2.0","32.3.0","32.3.1","32.4.0","32.5.0","32.5.0.post1","32.5.1","32.6.0","32.6.0.post1","32.7.0","32.8.0","32.8.1","32.8.2","32.8.3","32.8.4","32.8.5","32.8.6","33.0.0","33.0.0rc1","33.0.0rc2","33.0.0rc3","33.1.0","33.2.0","33.2.1","33.3.0","33.4.0","33.4.0.post1","33.5.0","33.6.0","33.6.1","34.0.0","34.0.0rc1","34.0.0rc2","34.1.0","34.2.0","34.3.0","34.4.0","34.4.1","34.4.2","34.4.3","34.5.0","34.6.0","35.0.0","35.0.0rc1","35.0.0rc2","35.0.1","35.1.0","35.1.1","35.2.0","35.2.1","35.3.0","35.4.0","35.4.1","35.5.0","35.6.0","35.6.1","35.7.0","35.8.0","35.8.1","35.8.2","36.0.0","36.0.0.post1","36.0.0.post2","36.0.0rc1","36.0.0rc2","36.0.0rc3","36.0.0rc4","36.0.0rc5","36.1.0","36.2.0","36.3.0","36.4.0","36.5.0","37.0.0","37.0.0rc1","37.0.0rc2","37.0.0rc3","37.0.0rc4","37.1.0","37.1.0.post1","37.2.0","37.3.0","37.4.0","37.5.0","37.6.0","37.7.0","37.7.1","38.0.0","38.0.0rc1","38.0.0rc2","38.0.0rc3","38.1.0","38.2.0","38.3.0","38.4.0","38.5.0","38.5.1","38.5.2","38.5.3","39.0.0","39.0.0rc1","39.0.0rc2","39.1.0","39.2.0","39.3.0"]}],"products":[{"vendor":"cern","product":"rucio"},{"vendor":"rucio","product":"rucio"}],"references":[{"url":"https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages","tags":["x_refsource_MISC","Not Applicable","web"]},{"url":"https://github.com/rucio/rucio/releases/tag/35.8.3","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/rucio/rucio/releases/tag/38.5.4","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/rucio/rucio/releases/tag/39.3.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25138","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-38wq-6q2w-hcf9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25138.json","tags":["advisory"]},{"url":"https://github.com/rucio/rucio","tags":["package"]},{"url":"https://pypi.org/project/rucio-webui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25138","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.","status":"published","published":"2026-02-25T19:28:35.628Z","modified":"2026-02-26T16:03:22.817Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-8712","description":"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.","status":"published","published":"2026-02-25T19:28:35Z","modified":"2026-02-26T16:03:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:25.997368Z"}],"ghsa":[{"id":"GHSA-38wq-6q2w-hcf9","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"### Summary\nThe WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames.\n\n### Details\nWhen submitting invalid credentials to `/ui/login`, the WebUI responds with different error messages based on the existence of the provided username (identity). A non-existent username results in an error indicating that no account is associated with the identity, while an existing username with an incorrect password produces a different authentication-related error.\n\nThis behavioral difference allows an attacker to distinguish valid usernames from invalid ones by observing the response content.\n\n### Proof of Concept\n**Bogus Login (Non-existent Username \"15251087\")**  \nResponse contains:\n```\nCannot get find any account associated with 15251087 identity.\n```\n\n**Bogus Login (Existing Username \"root\", Wrong Password)**  \nResponse contains:\n```\nCannot get auth token. It is possible that the presented identity root is not mapped to any Rucio account root.\n```\n\nThe difference in error messages confirms whether a username exists.\n\n### Impact\nAn unauthenticated attacker can enumerate valid usernames, which may be leveraged for targeted password guessing, credential stuffing, or social engineering attacks.\n\n### Remediation / Mitigation\nReturn a generic authentication failure message for all login errors, regardless of whether the username exists. Avoid disclosing account or identity existence through error responses. Consider implementing rate limiting or additional login throttling to further reduce abuse.\n\n#### Reources:\n- OWASP Authentication Cheat Sheet -  Authentication and Error Messages: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages","status":"published","published":"2026-02-25T18:53:42Z","modified":"2026-02-27T21:50:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T14:39:28.962954Z"}],"nvd":[{"id":"CVE-2026-25138","description":"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.","status":"published","published":"2026-02-25T20:23:47.457Z","modified":"2026-06-17T10:24:10.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-25138","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.","status":"published","published":"2026-02-25T19:28:35.628Z","modified":"2026-10-28T02:30:32.73322127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-38wq-6q2w-hcf9","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"### Summary\nThe WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames.\n\n### Details\nWhen submitting invalid credentials to `/ui/login`, the WebUI responds with different error messages based on the existence of the provided username (identity). A non-existent username results in an error indicating that no account is associated with the identity, while an existing username with an incorrect password produces a different authentication-related error.\n\nThis behavioral difference allows an attacker to distinguish valid usernames from invalid ones by observing the response content.\n\n### Proof of Concept\n**Bogus Login (Non-existent Username \"15251087\")**  \nResponse contains:\n```\nCannot get find any account associated with 15251087 identity.\n```\n\n**Bogus Login (Existing Username \"root\", Wrong Password)**  \nResponse contains:\n```\nCannot get auth token. It is possible that the presented identity root is not mapped to any Rucio account root.\n```\n\nThe difference in error messages confirms whether a username exists.\n\n### Impact\nAn unauthenticated attacker can enumerate valid usernames, which may be leveraged for targeted password guessing, credential stuffing, or social engineering attacks.\n\n### Remediation / Mitigation\nReturn a generic authentication failure message for all login errors, regardless of whether the username exists. Avoid disclosing account or identity existence through error responses. Consider implementing rate limiting or additional login throttling to further reduce abuse.\n\n#### Reources:\n- OWASP Authentication Cheat Sheet -  Authentication and Error Messages: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages","status":"published","published":"2026-02-25T18:53:42Z","modified":"2026-07-13T16:42:31.939877416Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2026-3053","title":"Rucio WebUI has Username Enumeration via Login Error Message","description":"### Summary\nThe WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames.\n\n### Details\nWhen submitting invalid credentials to `/ui/login`, the WebUI responds with different error messages based on the existence of the provided username (identity). A non-existent username results in an error indicating that no account is associated with the identity, while an existing username with an incorrect password produces a different authentication-related error.\n\nThis behavioral difference allows an attacker to distinguish valid usernames from invalid ones by observing the response content.\n\n### Proof of Concept\n**Bogus Login (Non-existent Username \"15251087\")**  \nResponse contains:\n```\nCannot get find any account associated with 15251087 identity.\n```\n\n**Bogus Login (Existing Username \"root\", Wrong Password)**  \nResponse contains:\n```\nCannot get auth token. It is possible that the presented identity root is not mapped to any Rucio account root.\n```\n\nThe difference in error messages confirms whether a username exists.\n\n### Impact\nAn unauthenticated attacker can enumerate valid usernames, which may be leveraged for targeted password guessing, credential stuffing, or social engineering attacks.\n\n### Remediation / Mitigation\nReturn a generic authentication failure message for all login errors, regardless of whether the username exists. Avoid disclosing account or identity existence through error responses. Consider implementing rate limiting or additional login throttling to further reduce abuse.\n\n#### Reources:\n- OWASP Authentication Cheat Sheet -  Authentication and Error Messages: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages","status":"published","published":"2026-07-13T14:36:38.66668Z","modified":"2026-07-13T16:32:44.020543348Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"}]}}