CVE-2026-25597: PrestaShop Auth Bypass Vulnerability

CVE-2026-25597 Overview

CVE-2026-25597 is a time-based user enumeration vulnerability affecting PrestaShop, a popular open source e-commerce web application. This vulnerability exists in the user authentication functionality and allows attackers to determine whether a customer account exists in the system by measuring response times during authentication attempts.

Time-based enumeration attacks exploit differences in server processing time when validating existing versus non-existing user accounts. By analyzing these timing discrepancies, attackers can build a list of valid user accounts for subsequent attacks such as credential stuffing, targeted phishing, or brute-force password attacks.

Critical Impact

Attackers can enumerate valid customer accounts in PrestaShop installations, enabling targeted attacks against confirmed users and potentially compromising customer data privacy.

Affected Products

• PrestaShop versions prior to 8.2.4
• PrestaShop versions prior to 9.0.3

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25597 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25597

Vulnerability Analysis

This vulnerability is classified under CWE-208 (Observable Timing Discrepancy), which occurs when two separate code paths in an application take different amounts of time to execute. In the context of PrestaShop's authentication system, the application exhibits measurably different response times when processing login requests for existing accounts versus non-existing accounts.

The timing discrepancy likely stems from additional database queries or cryptographic operations that only occur when validating credentials for a confirmed account. When an attacker submits authentication requests and carefully measures the response times, they can infer which accounts exist in the system without needing valid credentials.

This vulnerability is remotely exploitable over the network and requires no authentication or user interaction. While it does not directly compromise confidentiality of account credentials, it exposes information about which email addresses or usernames are registered in the system.

Root Cause

The root cause of this vulnerability lies in the authentication flow's failure to implement constant-time comparisons and response handling. When the authentication system checks for account existence before performing password validation, it creates a measurable timing difference between:

1. Requests for non-existent accounts (quick rejection)
2. Requests for existing accounts (additional password hashing and comparison operations)

Properly secured authentication systems should perform the same computational operations regardless of whether the account exists, ensuring response times remain consistent and do not leak information about account validity.

Attack Vector

The attack vector is network-based, allowing remote attackers to target any publicly accessible PrestaShop installation. The attack methodology involves:

1. Compiling a list of potential email addresses or usernames (from data breaches, OSINT, or generated lists)
2. Submitting authentication requests for each potential account
3. Measuring the server response time for each request with high precision
4. Analyzing the timing data to identify statistical outliers indicating valid accounts
5. Building a confirmed list of valid accounts for further exploitation

Automated tools can rapidly enumerate thousands of potential accounts, making this attack highly scalable against e-commerce platforms that may have large customer databases.

Detection Methods for CVE-2026-25597

Indicators of Compromise

• Abnormally high volume of failed authentication attempts from single or distributed IP addresses
• Systematic login attempts using alphabetical or sequential email address patterns
• Authentication requests with unusual precision timing patterns in access logs
• Automated request patterns with consistent intervals between login attempts

Detection Strategies

• Implement rate limiting detection on authentication endpoints to identify enumeration attempts
• Deploy web application firewall (WAF) rules to detect and block rapid sequential login attempts
• Monitor authentication logs for patterns indicative of automated enumeration tools
• Configure SentinelOne Singularity to detect suspicious authentication traffic patterns on web servers

Monitoring Recommendations

• Enable detailed access logging on PrestaShop authentication endpoints with timestamp precision
• Set up alerting for authentication failure rates exceeding baseline thresholds
• Monitor for distributed enumeration attempts originating from multiple IP addresses
• Implement real-time correlation of authentication events across your e-commerce infrastructure

How to Mitigate CVE-2026-25597

Immediate Actions Required

• Upgrade PrestaShop to version 8.2.4 or 9.0.3 immediately depending on your branch
• Implement rate limiting on authentication endpoints as a defense-in-depth measure
• Review authentication logs for evidence of prior enumeration attempts
• Enable CAPTCHA or progressive delays on login forms to slow automated attacks

Patch Information

PrestaShop has released security patches addressing this vulnerability in versions 8.2.4 and 9.0.3. Organizations should upgrade to the appropriate patched version based on their deployment:

• For PrestaShop 8.x installations: Upgrade to version 8.2.4
• For PrestaShop 9.x installations: Upgrade to version 9.0.3

Additional technical details are available in the GitHub Security Advisory GHSA-67v7-3g49-mxh2.

Workarounds

• Implement a reverse proxy or WAF with aggressive rate limiting on login endpoints
• Add artificial random delays to authentication responses to mask timing differences
• Deploy CAPTCHA challenges after a low threshold of failed authentication attempts
• Consider implementing account lockout policies to limit enumeration effectiveness