PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.
References
| Link | Resource |
|---|---|
| https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4 | Product Release Notes |
| https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3 | Product Release Notes |
| https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Feb 2026, 17:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Prestashop
Prestashop prestashop |
|
| References | () https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.4 - Product, Release Notes | |
| References | () https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.3 - Product, Release Notes | |
| References | () https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-67v7-3g49-mxh2 - Vendor Advisory | |
| CPE | cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* |
06 Feb 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-06 21:16
Updated : 2026-02-19 17:27
NVD link : CVE-2026-25597
Mitre link : CVE-2026-25597
CVE.ORG link : CVE-2026-25597
JSON object : View
Products Affected
prestashop
- prestashop
CWE
CWE-208
Observable Timing Discrepancy