What is GHSA-2frx-j9hj-6c65?

GHSA-2frx-j9hj-6c65 is a security advisory published by GitHub Security Advisories with Low severity. User enumeration in authentication mechanisms

Why does GHSA-2frx-j9hj-6c65 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-2frx-j9hj-6c65?

GHSA-2frx-j9hj-6c65 affects 2 products, including: composer/lexik/jwt-authentication-bundle:\u003c 2.10.7; composer/lexik/jwt-authentication-bundle:\u003e= 2.11.0, \u003c 2.11.3.

GHSA-2frx-j9hj-6c65LowDisclosed before NVD

User enumeration in authentication mechanisms

Vendor

GitHub Security Advisories

Published

May 17, 2021

Last Modified

January 9, 2023

📋 Description

Description

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.

Resolution

We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available here for branch 2.10.x and 2.x.

Credits

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.

🎯 Affected products2

composer/lexik/jwt-authentication-bundle:< 2.10.7
composer/lexik/jwt-authentication-bundle:>= 2.11.0, < 2.11.3

🔗 References (3)

https://github.com/lexik/LexikJWTAuthenticationBundle/security/advisories/GHSA-2frx-j9hj-6c65
https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7
https://github.com/advisories/GHSA-2frx-j9hj-6c65