{"action":"Upgrade @vendure/core to 3.5.3 or later.","affected":[{"fixed":"3.5.3","introduced":"0"}],"component":"@vendure/core","cve_ids":["CVE-2026-25050"],"ecosystem":"npm","epss":0.004,"exploited":false,"fixed_versions":["3.5.3"],"ghsa_id":"GHSA-6f65-4fv2-wwch","id":"tcs_01M5KF6QYZWCDYZX3RCZWWZK8P","modified_at":"2026-02-03T03:03:38.760480Z","published_at":"2026-01-30T19:35:40Z","references":["https://osv.dev/vulnerability/GHSA-6f65-4fv2-wwch","https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch","https://nvd.nist.gov/vuln/detail/CVE-2026-25050","https://github.com/vendurehq/vendure/commit/7f0c5556ecddb44a5d5208677a45fdd5923b0cc9","https://github.com/vendurehq/vendure","https://github.com/vendurehq/vendure/releases/tag/v3.5.3"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-6f65-4fv2-wwch","url":"https://osv.dev/vulnerability/GHSA-6f65-4fv2-wwch"},{"source":"nvd","source_id":"CVE-2026-25050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25050"}],"summary":"Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy"}