Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] User enumeration #1399

Open
printzm opened this issue Jan 16, 2025 · 0 comments
Open

[BUG] User enumeration #1399

printzm opened this issue Jan 16, 2025 · 0 comments

Comments

@printzm
Copy link

printzm commented Jan 16, 2025

Describe the bug
In order to prevent user enumeration, login errors should be generic (e.g., "login failed") and not specify why an authentication failure occurred (e.g., "wrong password", "username does not exist").

To Reproduce
What steps did you take when the issue occurred?

  1. Attempt to log in with invalid credentials (bad username or password).
  2. If the error message states "wrong password", you now know a valid username against which you can perform password guessing.

Expected behavior
The error should be generic. If it were, this type of user enumeration would not be possible, increasing the difficulty of attacks.

Screenshots

Image

Image

Operating system:
Ubuntu 22.04

CyberPanel version:
2.3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant