{"id":"GHSA-2frx-j9hj-6c65","aliases":[],"status":"published","title":"User enumeration in authentication mechanisms","description":"Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2021-05-17T20:52:21Z","modified":"2024-12-02T05:54:53Z","fixes":[{"ecosystem":"Packagist","package":"lexik/jwt-authentication-bundle","fixed_in":["2.10.7","2.11.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"lexik/jwt-authentication-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"lexik/jwt-authentication-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"lexik/jwt-authentication-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.7"}]}],"versions":["1.6.0","v1.0.0","v1.0.1","v1.0.10","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.5.0","v1.5.1","v1.7.0","v1.7.1","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.10.6","v2.2.0","v2.3.0","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.7.0","v2.8.0","v2.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"lexik/jwt-authentication-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}],"versions":["v2.11.0","v2.11.1","v2.11.2"]}],"references":[{"url":"https://github.com/lexik/LexikJWTAuthenticationBundle/security/advisories/GHSA-2frx-j9hj-6c65","tags":["web"]},{"url":"https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2frx-j9hj-6c65"},{"url":"https://github.com/lexik/LexikJWTAuthenticationBundle","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-2frx-j9hj-6c65","title":"User enumeration in authentication mechanisms","description":"Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.","status":"published","published":"2021-05-17T20:52:21Z","modified":"2023-01-09T05:05:11Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-2frx-j9hj-6c65","title":"User enumeration in authentication mechanisms","description":"Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.","status":"published","published":"2021-05-17T20:52:21Z","modified":"2024-12-02T05:54:53.242476Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}