Username Enumeration in SuiteCRM via OAuth2 Error Messages

Executive Summary

CVE-2026-100362 is a username enumeration vulnerability in SuiteCRM affecting versions 8.10.1 and below, as well as 7.15.1 and below. The issue lies in the V8 OAuth2 password-grant endpoint, which returns different error messages for invalid usernames versus invalid passwords. This allows unauthenticated attackers to determine valid user accounts by sending requests to the /legacy/Api/V8/OAuth2 endpoint and observing the responses.

Useful 0 Not Useful 0

Detection Guidance

Monitor the /legacy/Api/V8/OAuth2 endpoint for unusual authentication attempts. Check for repeated failed login attempts with distinct error messages for invalid usernames versus invalid passwords. Use network traffic analysis tools to inspect responses from this endpoint for patterns indicating username enumeration.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker can use the response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This could lead to unauthorized access to user accounts if weak or reused passwords are used.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuiteCRM to version 7.15.2 or 8.10.2 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the /legacy/Api/V8/OAuth2 endpoint via network controls or disable the OAuth2 password-grant endpoint if not required.

Useful 0 Not Useful 0