CyberRota Analysis
AI-GeneratedThelia v2.6.0 is vulnerable due to its administrative login and password recovery endpoints, which reveal distinct responses for invalid usernames versus incorrect passwords, enabling attackers to enumerate valid administrator accounts. The absence of rate limiting further exacerbates the risk, allowing for efficient large-scale username enumeration attacks. Organizations using this version should prioritize remediation to protect against potential unauthorized access to administrative accounts.
Original NVD Description
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.