CVE-2026-54739

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54739
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54739.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54739
Aliases
  • GHSA-xgg7-8hvq-8m65
Published
2026-08-19T20:16:01Z
Modified
2026-08-23T03:42:36Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
Details

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-204"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54739.json"
}
References

Affected packages

Git / github.com/lemmynet/lemmy

Affected ranges

Type
GIT
Repo
https://github.com/lemmynet/lemmy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
1edc9f922debc2c5b1aaaf29c495d7d4fe711b94
Fixed
f6e986e7e54d456aa1ffec38f1576c5bb15e0afd
Fixed
fe8b39b10bb70e9c0edca2df7a63c8f8d4059c98
Fixed
4d235a1b668b7dda6b73dbbc9ca289bb40acfa83
Fixed
59e968a5ac36d36d08a59028e2dbb92641536964
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.19.19"
        },
        {
            "introduced": "1.0.0-alpha.0"
        },
        {
            "fixed": "1.0.0-beta.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.0-rc.12
0.10.0-rc.13
0.10.0-rc.7
0.10.1
0.10.2
0.11.0
0.11.0-rc.1
0.11.1
0.11.2
0.11.3-rc.4
0.11.4-rc.16
0.12.0
0.12.0-rc.1
0.12.0-rc.2
0.13.0
0.13.0-rc.1
0.13.5-rc.7
0.13.6-rc.2
0.14.0
0.14.0-rc.1
0.14.0-rc.2
0.14.1
0.14.2
0.14.2-rc.1
0.14.3
0.15.0
0.15.0-rc.7
0.15.1
0.16.0
0.16.0-rc.1
0.16.0-rc.2
0.16.0-rc.3
0.16.0-rc.4
0.16.1
0.16.1-rc.1
0.16.2
0.16.2-rc.1
0.16.2-rc.2
0.16.2-rc.3
0.16.3
0.16.3-rc.1
0.16.5
0.17.0
0.17.0-rc.1
0.17.0-rc.3
0.17.0-rc.4
0.17.1
0.18.0
0.18.0-rc.1
0.18.0-rc.2
0.18.0-rc.3
0.18.0-rc.4
0.18.0-rc.5
0.18.0-rc.6
0.18.0-rc.8
0.18.1
0.18.1-rc.1
0.18.1-rc.10
0.18.1-rc.4
0.18.1-rc.9
0.18.4-beta.7
0.19.0
0.19.0-beta.7
0.19.0-rc.1
0.19.0-rc.10
0.19.0-rc.11
0.19.0-rc.12
0.19.0-rc.13
0.19.0-rc.14
0.19.0-rc.15
0.19.0-rc.16
0.19.0-rc.2
0.19.0-rc.3
0.19.0-rc.4
0.19.0-rc.5
0.19.0-rc.6
0.19.0-rc.7
0.19.0-rc.8
0.19.1-rc.1
0.19.1-rc.2
0.19.10
0.19.10-beta.0
0.19.10-beta.1
0.19.10-beta.2
0.19.11
0.19.11-beta.0
0.19.11-beta.1
0.19.11-beta.2
0.19.12
0.19.12-beta.0
0.19.12-beta.1
0.19.12-beta.10
0.19.12-beta.11
0.19.12-beta.12
0.19.12-beta.2
0.19.12-beta.3
0.19.12-beta.4
0.19.12-beta.5
0.19.12-beta.6
0.19.12-beta.7
0.19.12-beta.8
0.19.12-beta.9
0.19.13
0.19.13-beta.1
0.19.14
0.19.14-beta.0
0.19.14-beta.1
0.19.14-beta.2
0.19.15
0.19.15-beta.0
0.19.16
0.19.16-beta.0
0.19.16-beta.1
0.19.17
0.19.17-beta.0
0.19.18
0.19.18-beta.0
0.19.18-beta.1
0.19.18-beta.3
0.19.19
0.19.19-beta.0
0.19.19-beta.1
0.19.2
0.19.2-rc.1
0.19.2-rc.2
0.19.2-rc.4
0.19.2-rc.5
0.19.3
0.19.3-rc.1
0.19.4
0.19.4-beta.1
0.19.4-beta.3
0.19.4-beta.4
0.19.4-beta.5
0.19.4-beta.6
0.19.4-beta.7
0.19.4-beta.8
0.19.4-rc.1
0.19.4-rc.10
0.19.4-rc.11
0.19.4-rc.2
0.19.4-rc.3
0.19.4-rc.4
0.19.4-rc.5
0.19.4-rc.6
0.19.4-rc.7
0.19.4-rc.8
0.19.4-rc.9
0.19.5
0.19.5-alpha.1
0.19.5-alpha.2
0.19.5-alpha.3
0.19.6
0.19.6-beta.14
0.19.6-beta.15
0.19.6-beta.8
0.19.6-beta.9
0.19.7
0.19.7-beta.1
0.19.7-beta.2
0.19.8
0.19.8-beta.0
0.19.9
0.19.9-beta.0
0.19.9-beta.1
0.19.9-beta.2
0.19.9-beta.3
0.19.9-beta.4
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
1.*
1.0.0-alpha.0
1.0.0-alpha.1
1.0.0-alpha.10
1.0.0-alpha.12
1.0.0-alpha.18
1.0.0-alpha.19
1.0.0-alpha.2
1.0.0-alpha.3
1.0.0-alpha.4
1.0.0-alpha.5
1.0.0-alpha.6
1.0.0-alpha.7
1.0.0-alpha.9
1.0.0-beta.0
v0.*
v0.0.7.4
v0.0.8.1
v0.0.8.2
v0.0.8.3
v0.4.0.3
v0.5.10
v0.7.17
v0.7.18
v0.7.19
v0.7.20
v0.7.21
v0.7.22
v0.7.23
v0.7.24
v0.7.25
v0.7.26
v0.7.28
v0.7.29
v0.7.3
v0.7.30
v0.7.31
v0.7.32
v0.7.33
v0.7.34
v0.7.35
v0.7.36
v0.7.37
v0.7.38
v0.7.39
v0.7.4
v0.7.40
v0.7.41
v0.7.42
v0.7.43
v0.7.44
v0.7.46
v0.7.47
v0.7.48
v0.7.49
v0.7.5
v0.7.50
v0.7.52
v0.7.53
v0.7.54
v0.7.55
v0.7.56
v0.7.57
v0.7.59
v0.7.6
v0.7.61
v0.7.62
v0.7.63
v0.7.64
v0.7.7
v0.7.8
v0.8.0
v0.8.1
v0.8.10
v0.8.3
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54739.json"