CVE-2026-54739: Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/localuser/login.rs returns different errors depending on whether the usernameoremail value exists. LocalUserView::findbyemailorname propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lemmyto a version that resolves this vulnerability.Fixed in 0.19.19 - Upgrade
Upgrade
lemmyto a version that resolves this vulnerability.Fixed in 1.0.0-beta.1
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can probe the login endpoint. They only need candidate usernames or email addresses; no valid account or password is required.
How can I determine whether an instance is vulnerable?
Submit login attempts with a known nonexistent username or email and with an existing account using an incorrect password. A vulnerable instance returns HTTP 404 for the nonexistent account and HTTP 400 for the existing account with a wrong password.
Which versions contain the fix?
The issue is fixed in Lemmy 0.19.19 and 1.0.0-beta.1. Versions prior to those releases are affected.