CVE-2026-24664: Open eClass Username Enumeration Flaw

CVE-2026-24664 Overview

A username enumeration vulnerability has been identified in Open eClass platform (formerly known as GUnet eClass), a complete course management system used by educational institutions. Prior to version 4.2, the platform allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This information disclosure weakness (CWE-204) enables attackers to build lists of valid usernames for use in subsequent targeted attacks such as credential stuffing or phishing campaigns.

Critical Impact

Unauthenticated attackers can enumerate valid user accounts through login response analysis, potentially enabling targeted attacks against educational institution users and staff.

Affected Products

• Open eClass platform versions prior to 4.2
• GUnet eClass (legacy naming) versions prior to 4.2

Discovery Timeline

• 2026-02-03 - CVE-2026-24664 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24664

Vulnerability Analysis

This vulnerability falls under CWE-204 (Observable Response Discrepancy), which occurs when an application returns different responses that allow an attacker to distinguish between valid and invalid usernames. In the context of Open eClass, the login functionality exhibits measurably different behavior when a valid username is submitted compared to an invalid one. This discrepancy can manifest through various observable differences including response content, timing variations, or HTTP status codes.

Username enumeration vulnerabilities are particularly concerning in educational platforms like Open eClass because they expose student and faculty account information. Attackers can leverage this information to conduct targeted phishing campaigns, credential stuffing attacks using leaked password databases, or social engineering attacks against specific users.

Root Cause

The root cause of this vulnerability lies in the authentication mechanism's handling of login attempts. When processing login requests, the application provides distinguishable responses based on whether the supplied username exists in the system. This information leakage allows attackers to methodically test usernames and identify which accounts are valid without authentication.

Attack Vector

The attack is conducted over the network and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending multiple login requests with different usernames to the Open eClass login endpoint
2. Analyzing the response behavior (content, timing, or status codes) for each request
3. Identifying patterns that distinguish valid usernames from invalid ones
4. Compiling a list of valid user accounts for further attack phases

This reconnaissance phase is typically automated using scripts that iterate through wordlists of potential usernames, making it trivial to enumerate large numbers of accounts quickly.

Detection Methods for CVE-2026-24664

Indicators of Compromise

• Unusually high volume of failed login attempts from single or distributed IP addresses
• Sequential or patterned login attempts with different usernames but similar or identical passwords
• Rapid-fire authentication requests targeting the login endpoint
• Login attempts using common username wordlists or educational email patterns

Detection Strategies

• Implement rate limiting detection to identify sources exceeding normal login attempt thresholds
• Monitor authentication logs for patterns consistent with enumeration (many unique usernames, few successful logins)
• Deploy web application firewall (WAF) rules to detect and block username enumeration patterns
• Correlate authentication events with threat intelligence feeds for known attacker infrastructure

Monitoring Recommendations

• Enable detailed logging on the Open eClass authentication endpoint including client IP, timestamp, and username attempted
• Configure alerting for authentication anomalies exceeding baseline thresholds
• Review authentication logs regularly for reconnaissance activity patterns
• Monitor for credential stuffing attacks that may follow successful enumeration

How to Mitigate CVE-2026-24664

Immediate Actions Required

• Upgrade Open eClass to version 4.2 or later immediately
• Implement account lockout policies to limit enumeration attempts
• Deploy rate limiting on authentication endpoints
• Enable multi-factor authentication (MFA) to reduce the impact of compromised credentials
• Review recent authentication logs for signs of enumeration activity

Patch Information

The vulnerability has been addressed in Open eClass version 4.2. Organizations should upgrade to this version or later to remediate the issue. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Implement a web application firewall (WAF) with rules to detect and block enumeration attempts
• Configure rate limiting on the authentication endpoint to slow down automated attacks
• Use generic error messages for all login failures (e.g., "Invalid username or password") to prevent response analysis
• Deploy CAPTCHA challenges after a threshold of failed login attempts from a single source
• Consider placing the login page behind a reverse proxy with additional security controls