The flaw is a timing side‑channel in the password reset endpoint that leaks whether a username or email exists. An unauthenticated caller receives a fixed two‑second delay when a target is absent, but a noticeably faster response when the target is present because a database update and email are performed. This difference allows an attacker to enumerate valid accounts, which aids credential‑stuffing or targeted phishing. The weakness is a classic timing side‑channel vulnerability (CWE‑208).

The issue affects ApostropheCMS versions 4.28.0 and earlier. It only poses a risk when the passwordReset feature is enabled, which defaults to false. The affected product is the Node.js content‑management system developed by apostrophecms under the name apostrophe.

The CVSS base score is 3.7, indicating a low‑severity vulnerability. EPSS is not available, making it unclear how frequently it has been exploited, and the item is not listed in CISA's KEV catalog. An attacker would issue unauthenticated HTTP requests to /api/v1/@apostrophecms/login/reset-request, observe response times, and map valid usernames or email addresses. The lack of rate limiting allows automated scripts to conduct enumeration quickly. Without additional controls, enumerated accounts can be used in credential stuffing or social‑engineering attacks.