userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.
Attackers send POST requests to the existingUsernameCheck.php endpoint, submitting successive usernames to check. The application returns different text responses depending on whether a given username exists in the system — the presence of the string 'taken' in the response indicates the existence of an account. By analyzing these responses, attackers can effectively identify existing accounts without possessing any credentials (CWE-204: Observable Response Discrepancy).
An attacker can build a list of valid usernames registered in the system, which significantly facilitates the execution of targeted account attacks (e.g., dictionary attacks or credential stuffing).
Patches available from the vendor should be applied in accordance with the references. Additionally, it is recommended to standardize the responses returned by the existingUsernameCheck.php endpoint so that they do not reveal account existence information, and to consider restricting access to this endpoint only for authenticated users.
userSpice version 4.3.24
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X