{"id":"GHSA-2frx-j9hj-6c65","aliases":[],"title":"User enumeration in authentication mechanisms","description":"Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.","severity":"low","score":null,"published":"2021-05-17T20:52:21.000Z","modified":"2024-12-02T05:54:53.242Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"lexik/jwt-authentication-bundle","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.10.7"}],"type":"ECOSYSTEM"}],"versions":["1.6.0","v1.0.0","v1.0.1","v1.0.10","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.2.0","v1.3.0","v1.3.1","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.5.0","v1.5.1","v1.7.0","v1.7.1","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.1.0","v2.1.1","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.10.5","v2.10.6","v2.2.0","v2.3.0","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.7.0","v2.8.0","v2.9.0"],"fixed":["2.10.7"]},{"ecosystem":"Packagist","name":"lexik/jwt-authentication-bundle","ranges":[{"events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}],"type":"ECOSYSTEM"}],"versions":["v2.11.0","v2.11.1","v2.11.2"],"fixed":["2.11.3"]}],"references":["https://github.com/lexik/LexikJWTAuthenticationBundle/security/advisories/GHSA-2frx-j9hj-6c65","https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7","https://github.com/lexik/LexikJWTAuthenticationBundle"],"sources":[{"name":"OSV","id":"GHSA-2frx-j9hj-6c65","modified":"2024-12-02T05:54:53.242476Z","url":"https://osv.dev/vulnerability/GHSA-2frx-j9hj-6c65"}],"assessments":[]}