What is GHSA-67v7-3g49-mxh2?

GHSA-67v7-3g49-mxh2 is a security advisory published by GitHub Security Advisories with Medium severity. PrestaShop affected by time based enumeration in FO login form

Which CVE IDs does GHSA-67v7-3g49-mxh2 cover?

GHSA-67v7-3g49-mxh2 covers the following CVE IDs: CVE-2026-25597. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-67v7-3g49-mxh2?

GHSA-67v7-3g49-mxh2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-67v7-3g49-mxh2?

GHSA-67v7-3g49-mxh2 affects 2 products, including: composer/prestashop/prestashop:\u003e= 9.0.0-alpha.1, \u003c 9.0.3; composer/prestashop/prestashop:\u003c 8.2.4.

GHSA-67v7-3g49-mxh2MediumCVSS 5.3

PrestaShop affected by time based enumeration in FO login form

Vendor

GitHub Security Advisories

Published

February 3, 2026

Last Modified

February 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-25597 →

📋 Description

Impact

A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.

Patches

8.2.4 and 9.0.3

Workarounds

none

References

Found by Lam Yiu Tung

🎯 Affected products2

composer/prestashop/prestashop:>= 9.0.0-alpha.1, < 9.0.3
composer/prestashop/prestashop:< 8.2.4

🔗 References (5)

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2
https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4
https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3
https://nvd.nist.gov/vuln/detail/CVE-2026-25597
https://github.com/advisories/GHSA-67v7-3g49-mxh2