FormaLMS User Enumeration Vulnerability in Password Recovery Functionality

A user enumeration vulnerability has been identified in FormaLMS versions 4.1.18 and below. This vulnerability resides in the password recovery feature accessible through the '/lostpwd' endpoint. The application differentiates between valid and invalid usernames by returning distinct error messages. For instance, non-existent usernames trigger a message stating, 'The username you've inserted doesn't exist. Please check and retry.' This discrepancy allows an unauthenticated attacker to ascertain which usernames are registered in the system. Such information could be exploited for targeted brute-force or credential stuffing attacks.

Impact

Exploitation of this vulnerability allows for user enumeration, enabling attackers to identify registered usernames. This information could be used to conduct targeted brute-force or credential stuffing attacks.