CVE Explorer
CVE-2026-24468
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the system. When a non-existent email is provided in the login parameter, the endpoint returns an HTTP 400 response (Bad Request). When a valid email is supplied, the endpoint responds with HTTP 200. This differe
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"openaev","vendor":"OpenAEV-Platform","versions":[{"status":"affected","version":">= 1.11.0, < 2.0.13"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-204","description":"CWE-204: Observable Response Discrepancy","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120","tags":["x_refsource_MISC"],"url":"https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/references/2
{"name":"https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52","tags":["x_refsource_MISC"],"url":"https://github.com/OpenAEV-Platform/openaev/commit/3430fe23a9244030d06fdf8e6771592e1f12ad52"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/references/1
{"name":"https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13","tags":["x_refsource_MISC"],"url":"https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/references/3
{"name":"https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph","tags":["x_refsource_CONFIRM"],"url":"https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-v6rg-hf9w-f8ph"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:aa51531be54d01ca4b474c20e9ba826f4705f535190f3a311f60e6878cd4dbbf · sha256:b41daa188fd3adf5… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.