CVE-2026-54739

Received Received - Intake

Username Enumeration in Lemmy Login Endpoint

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54739

EUVD

EUVD-2026-62847

Affected Vendors & Products

Vendor	Product	Version / Range
lemmy	lemmy	to 0.19.19 (inc)
lemmy	lemmy	to 1.0.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Lemmy versions before 0.19.19 and 1.0.0-beta.1 allows unauthenticated attackers to check if a username or email exists by observing different error responses. The login endpoint returns HTTP 404 for non-existent accounts and HTTP 400 for incorrect passwords on existing accounts, enabling username enumeration for credential attacks or social engineering.

Detection Guidance

This vulnerability can be detected by observing different HTTP responses for valid vs invalid usernames during login attempts. Send requests to the login endpoint and check if responses differ between existing and non-existing accounts (e.g., HTTP 400 vs HTTP 404).

Example: Use curl to test responses. For a valid account: curl -X POST -d 'username_or_email=test&password=wrong' http://target/lemmy/login. For invalid: curl -X POST -d 'username_or_email=invalid&password=wrong' http://target/lemmy/login. Compare status codes.

Impact Analysis

Attackers could use this flaw to identify valid accounts on a Lemmy instance, which may lead to targeted brute-force attacks, phishing attempts, or social engineering campaigns against those accounts. It compromises user privacy by exposing registered usernames or emails.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR by exposing personal data (usernames/emails) without consent. It could also breach HIPAA if user accounts contain protected health information, as unauthorized disclosure may occur.

Mitigation Strategies

Upgrade Lemmy to version 0.19.19 or 1.0.0-beta.1 or later to fix the issue. If immediate upgrade is not possible, implement rate limiting and account lockout policies on the login endpoint to prevent enumeration attempts.

Hi! I’m here to help you understand CVE-2026-54739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70