CVE-2026-24664: Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies
Published Feb 3, 2026
·Updated
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This issue has been patched in version 4.2.
Affected Software
2 affected components
Open eClass Open eClass<4.2
GUnet Open eClass Platform<4.2
Event History
Feb 3, 2026
CVE Published
via MITRE·04:56 PM
Data Sourced
via MITRE·04:56 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 19, 58090
Event
via FIRST·11:25 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-24664?
The severity of CVE-2026-24664 is rated as medium due to the potential for username enumeration.
2
How do I fix CVE-2026-24664?
To fix CVE-2026-24664, upgrade to Open eClass version 4.2 or later.
3
What does CVE-2026-24664 exploit?
CVE-2026-24664 exploits discrepancies in login responses to allow username enumeration.
4
Who is affected by CVE-2026-24664?
Users of Open eClass prior to version 4.2 are affected by CVE-2026-24664.
5
Can CVE-2026-24664 be exploited by authenticated users?
CVE-2026-24664 can be exploited by unauthenticated attackers.