CVE-2026-54739

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1

Description The login endpoint in crates/api/api/src/local user/login.rs exhibits a response discrepancy based on the existence of a user account. The function LocalUserView::find by email or name() returns a NotFound response (HTTP 404) for unknown accounts, whereas existing accounts with an incorrect password return a LemmyErrorType::IncorrectLogin response (HTTP 400). This behavior allows an unauthenticated attacker to use the username or email parameter to enumerate registered usernames or email addresses, facilitating targeted credential attacks or social engineering.

Recommendations Update to version 0.19.19. Update to version 1.0.0-beta.1.