CVE-2026-53908

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and email addresses.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-539096.5MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can bCVE-2026-53916.4The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_reCVE-2026-539102.1diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculaCVE-2026-539116.3Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain CVE-2026-539125.1Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrCVE-2026-539139.8Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel KCVE-2026-539149.8In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadataCVE-2026-539158.8In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configurationCVE-2026-539167.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticatCVE-2026-539177.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ BCVE-2026-539188.8odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a peCVE-2026-53925.4Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the in