OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This difference in server responses creates an observable discrepancy that allows an attacker to reliably determine which emails are registered in the application. By automating requests with a list of possible email addresses, an attacker can quickly build a list of valid accounts without any authentication. The endpoint should return a consistent response regardless of whether the username exists in order to prevent account enumeration. Version 2.0.13 fixes this issue.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-204"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24468.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24468.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "118731714162958657357727756839818581020",
"length": 360
},
"id": "CVE-2026-24468-1704c320",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java",
"function": "impersonateUser"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1241899034032331468906609117550100501",
"length": 3052
},
"id": "CVE-2026-24468-18ba9913",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java",
"function": "createInjectForScenario"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "27755135592450568062156706376928189569",
"length": 117
},
"id": "CVE-2026-24468-1b11ff5c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java",
"function": "me"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"220418636997049011585371381517873112707",
"10562543787512725777096363797110617719",
"249756791790099966412053508543005354530",
"152001544139915467724044155067057413753"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-211d35db",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/objective/ScenarioObjectiveApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257102493619548470385867546338064797893",
"length": 654
},
"id": "CVE-2026-24468-22ed3bc5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/objective/ExerciseObjectiveApi.java",
"function": "createEvaluation"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"209513797376024578438921955048918023783",
"287246949350328184955190751706737079239",
"234270288025103046590580186268820544414",
"96313259243997916473277684245445129877",
"186545640864995823135792143708076171271"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-2dc29d9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/test/java/io/openbas/utils/fixtures/UserFixture.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "305788992494372943714941970170968423159",
"length": 381
},
"id": "CVE-2026-24468-31ddebfe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java",
"function": "updateProfile"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "33319208797616975251042054824814843217",
"length": 470
},
"id": "CVE-2026-24468-335ca956",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/PlayerApi.java",
"function": "players"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "275116976835350891488339537673347352504",
"length": 560
},
"id": "CVE-2026-24468-3456570f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java",
"function": "checkUserAccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200602150207943072523437720350068975355",
"length": 1568
},
"id": "CVE-2026-24468-3be12b21",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/document/DocumentApi.java",
"function": "updateDocumentInformation"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271806269912263012539851545459799168691",
"length": 488
},
"id": "CVE-2026-24468-3e1ce8ca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java",
"function": "createLog"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195214370240039868007380279151133603895",
"225756531302220808493786811555254639416",
"33879021610737174995696413860803486418",
"79956915923998355602486509561765167122",
"82247408074499894855537059964576642074"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-4285e559",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/MailingService.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"220418636997049011585371381517873112707",
"10562543787512725777096363797110617719",
"249756791790099966412053508543005354530",
"152001544139915467724044155067057413753"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-4b011f89",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/objective/ExerciseObjectiveApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "75247888360854962199004648315088816102",
"length": 922
},
"id": "CVE-2026-24468-4d0aac2b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/MailingService.java",
"function": "sendEmail"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36655827237207235063171336429751994002",
"length": 463
},
"id": "CVE-2026-24468-573bee5c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java",
"function": "checkOrganizationAccess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"271503898886207324346532886419671918912",
"55486770520857008974378488982445727361",
"152796329024395714447574721989221403633",
"326027135222875151166834456090964474031"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-58a5ae9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/team/TeamApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "113161662345243175261525399992152934873",
"length": 463
},
"id": "CVE-2026-24468-5cc7a38e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java",
"function": "createDryrun"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222979121417343013281797481693969022440",
"length": 462
},
"id": "CVE-2026-24468-5d828fee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java",
"function": "nextInjectsToExecute"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109128578078324962450888797153296049024",
"length": 6503
},
"id": "CVE-2026-24468-63b5191d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/InjectImportService.java",
"function": "importRow"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"7336103507171403173679842322237644313",
"189359648221240640914885127120082608667",
"72404660394420363004937300900054927189",
"298027402622135663808672269981229994989",
"265256979295194526481074868076998161230",
"204551015267828429807168646637992188590",
"157828928204001237694853659277979810842",
"121626184901736029450084345821119783715"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-65a33a40",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/document/DocumentApi.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"210289354361673741201014646669949115348",
"129357642099755629748396817863750534251",
"120157541693370649204303605194768131578",
"297826561551626465507113945579474063143"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-6c2967a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/AtomicTestingService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "63061504929828136562100665276749479000",
"length": 501
},
"id": "CVE-2026-24468-7157d1a3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/team/TeamApi.java",
"function": "getTeams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109817088576123241369415150096243787633",
"length": 1069
},
"id": "CVE-2026-24468-77b52274",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/UserApi.java",
"function": "passwordReset"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"189413162997191766437897035294065488189",
"154577995164090239308480373277431133880",
"214367807576862836348974698907762910768",
"161157126763787420961754951254031316836",
"108742034920930628317805723881607904439",
"397814837417814761223512355851824299",
"17185176310295014257839936375408102181",
"321064603976316794775717347023871867230",
"186562358545664271064439592067288786233",
"26778751659090952293585540934667490246",
"320514594202644542075493044674786460497",
"126039850944375958380293827552871293666",
"315602064441539267476179200134396049539"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-7a0b7efb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/UserApi.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"303001330592552884921069526330573798879",
"55486770520857008974378488982445727361",
"152796329024395714447574721989221403633",
"326027135222875151166834456090964474031"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-8d49dd1c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/PlayerApi.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"335191004891199814053997595230368182126",
"91627788988706272177669468281962164797",
"255007715926285299591831365856749694074",
"90890759429861002830685527082616431749",
"288312587275251654208363012825655564719",
"50333432259325044824724765047251392274",
"52881887922403823982833091746228739002",
"36985685481477880918723121456915184436"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-995e4d60",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/exercise/ExerciseApi.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"43830854011447351514184810133874679519",
"141005167901095497432749871262995520025",
"86563638940291396160726315191349488675",
"233065139704719197692189453035002401153"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-9ebc232a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/InjectImportService.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"55536966860300410151278046399947005966",
"55778711680375044018131931914245248968",
"314984594526432419727467014842467067817",
"173469189671169028124905525198034175674",
"165187152167659462340014637765155797497",
"302827717939142020858000869318922372275",
"339010914890531796331724521203949076518",
"180565864265621991220344023590286492239",
"221984606728660217559472529548068436417",
"283673958033283498462537545417192389520",
"37756060387851320412373265231079917014",
"256973884174422040319505770597865421625",
"162103188880650732449861040598855449820",
"196537138192576764320747251650439136909",
"216415208576656409079323401691532299670",
"121833396242368603848201676479424382745",
"9810098031077103782996278627652425121"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-b166220f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/test/java/io/openbas/rest/UserApiTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101719528202252572155431017050047213011",
"length": 654
},
"id": "CVE-2026-24468-b1e48572",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/objective/ScenarioObjectiveApi.java",
"function": "createEvaluation"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167264223292735504216901965071504085977",
"69958031325570115663750237950442692821",
"268360527583551156185677180908533754334",
"317644594767835466527745096152481214066",
"202923793367119747675996782624568169807",
"268363272491708490403307514617251092018",
"19548845974537797036691580117777248120",
"247663221990601679573225846304953332896",
"79463171596179283237442035017974037604",
"247986598977257778164439338370122013777",
"96830864105940306628173911232086241209",
"104691821150955131929974453749891262243",
"262966189541031205962458751812646299671",
"186906806854922330110746564104400259249",
"84224750581954927819858721537265572622",
"104691821150955131929974453749891262243",
"262966189541031205962458751812646299671",
"186906806854922330110746564104400259249"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-b228fa08",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/helper/RestBehavior.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"334909572173385609921917803457834977890",
"221562792003221318205073149935476206101",
"92117295378228296831891496097245793942",
"139563395044375414268738846564939618453",
"325108471750819262224276549298200739005",
"87094381092105061182544626195966095484",
"318658043441678100509108692737277503480",
"113740811653556666793374885645908552404",
"64499014720206721102185383147289891365",
"251291709619826456302688995710201938013",
"20155825033660401536673109809540502113",
"284599633291032321808710712570333020095"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-cd9da3f7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217653327424913309168233766995316115577",
"length": 1707
},
"id": "CVE-2026-24468-d52c0c90",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/service/AtomicTestingService.java",
"function": "createOrUpdate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"157997644776284207804760460377614328926",
"199897818463269305862534889353496608322",
"87208347235283831831865048532498093537",
"330377069019314375143968640890373831132",
"239152056434010956097049023084399952176",
"301341221774320804697870731467574782979",
"328580177296315329329836134682832936263",
"303921844526172606689813537900709469174",
"318019119223863942712399255802849789831",
"283167409886407694125382817283492564054",
"66161595552485097860640617573680093769",
"326800481775184699085591363277257707732",
"131261966179525058714120707269591826410",
"57876046589718322722650264856916475377",
"247015083226000740890623291814181766616",
"113095888306916492662768347085062996810",
"4744233800750313191932191288572696227",
"201069491362029189670283172173057888009",
"54119004225830451441239877622540407825",
"259174931096482826169425096049245682688",
"85798184665701319191458608541833289535",
"152422121570531409660616000272665163651"
],
"threshold": 0.9
},
"id": "CVE-2026-24468-d97867d9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292818037857105582382713067549724488114",
"length": 3032
},
"id": "CVE-2026-24468-f6360e76",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/inject/InjectApi.java",
"function": "createInjectForExercise"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313343562535332086198593921193255150376",
"length": 500
},
"id": "CVE-2026-24468-f6e19216",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java",
"function": "renewToken"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "9644963055284745074939541645214821883",
"length": 432
},
"id": "CVE-2026-24468-fa557197",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java",
"function": "updatePassword"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314339354462751593749699476516877170042",
"length": 280
},
"id": "CVE-2026-24468-fee0f18c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openaev-platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52",
"target": {
"file": "openbas-api/src/main/java/io/openbas/rest/user/MeApi.java",
"function": "updateInformation"
}
}
]
"2026-08-12T15:31:57Z"