What’s Vulnerable › Vulnerabilities

CVE-2026-81033: Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-23
• Weakness: CWE-204

Description

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.

Affected products

• automatisch: through 0.15.0

References

• https://github.com/automatisch/automatisch
• https://github.com/automatisch/automatisch/blob/v0.15.0/packages/backend/src/controllers/internal/api/v1/users/forgot-password.js
• https://github.com/automatisch/automatisch/issues/2713
• https://www.vulncheck.com/advisories/automatisch-through-0.15.0-user-enumeration-via-forgot-password-response-discrepancy

Get alerted when CVE-2026-81033 or the next vulnerability affects your stack