The vulnerability resides in Vendure’s NativeAuthenticationStrategy where the authenticate method exits immediately for unknown users, creating a measurable timing gap compared to existing accounts. This timing discrepancy, roughly 200-400 milliseconds for bcrypt password verification versus only 1-5 milliseconds for a database miss, can be leveraged by an attacker to reliably determine whether a specific email address corresponds to a valid account. The outcome is information disclosure in the form of enumerating valid user identities, potentially aiding further credential-based attacks.

Vendure, the open‑source headless commerce platform maintained by vendurehq. Any deployment using a release prior to version 3.5.3 is affected. The fix was introduced in release 3.5.3 and later versions are not vulnerable.

The CVSS score of 2.7 indicates a low severity impact, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in the CISA KEV catalog. Although the attack vector is remote—requiring only repeated authentication requests against the public API—an attacker can craft automated timing measurements to enumerate accounts. The weakness is a timing side‑channel and therefore requires no additional privileges or special conditions to exploit.