GMS-2021-53: User enumeration in authentication mechanisms

May 17, 2021 (updated October 8, 2021)

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.

References

github.com/advisories/GHSA-2frx-j9hj-6c65
github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7
github.com/lexik/LexikJWTAuthenticationBundle/security/advisories/GHSA-2frx-j9hj-6c65

Code Behaviors & Features

Detect and mitigate GMS-2021-53 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →