ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

Description

The password reset endpoint (/api/v1/@apostrophecms/login/reset-request) exhibits a measurable timing side channel that allows unauthenticated attackers to enumerate valid usernames and email addresses.

Recommendation

Update the apostrophe package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.29.0
• Patched version(s): 4.29.0

References

• GHSA-mj7r-x3h3-7rmr
• CVE-2026-33877
• CWE-208
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to user enumeration via email verification endpoint - CVE-2026-31901
• Parse Server has a login timing side-channel reveals user existence - CVE-2026-39321
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views - @strapi/plugin-content-manager - CVE-2023-36472
• ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware - CVE-2026-32730

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

apostrophe