Medium
Rucio WebUI has Username Enumeration via Login Error Message
Type: advisorySources: OSV
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-25138
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:05 UTC · Revision 1
Source evidence
Rucio WebUI has Username Enumeration via Login Error Message
core-osv · Original sourcePublished 25 Feb 2026, 19:28 UTC
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
osv:CVE-2026-25138
Complete source record
{
"id": "e49a7e951db771409ce4155c41e8583b79e41c80ed78cbd88c56a05a268a8e8c",
"url": "https://osv.dev/vulnerability/CVE-2026-25138",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Rucio WebUI has Username Enumeration via Login Error Message",
"summary": "Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.",
"evidence": "osv:CVE-2026-25138",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-25138",
"aliases": [
"CVE-2026-25138",
"GHSA-38wq-6q2w-hcf9",
"PYSEC-2026-3053"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rucio/rucio",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ba9203702629af7bb1f95d5cf9ba8fcf1f943105"
},
{
"introduced": "46cc73438ba4042ac937fff1c5a0dfabc83e91f3"
},
{
"fixed": "c851ad216e0e0e3d50405eab3331dfe21c96ddd3"
},
{
"introduced": "45b19709d28ecccc39cd0e73e4087a7e79a71c49"
},
{
"fixed": "ba2a7e66b1e3c73b5cf9e0000e6621e8dc45bfe7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "35.8.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "36.0.0"
},
{
"fixed": "38.5.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "39.0.0"
},
{
"fixed": "39.3.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "ba9203702629af7bb1f95d5cf9ba8fcf1f943105"
}
],
"source": "REFERENCES_TAG",
"original_tag": "35.8.3"
},
{
"range": [
{
"fixed": "c851ad216e0e0e3d50405eab3331dfe21c96ddd3"
}
],
"source": "REFERENCES_TAG",
"original_tag": "38.5.4"
},
{
"range": [
{
"fixed": "ba2a7e66b1e3c73b5cf9e0000e6621e8dc45bfe7"
}
],
"source": "REFERENCES_TAG",
"original_tag": "39.3.1"
}
]
}
}
],
"versions": [
"35.8.2",
"39.3.0",
"38.5.3",
"38.5.2",
"39.2.0",
"38.5.1",
"39.1.0",
"39.0.0",
"38.5.0",
"38.4.0",
"38.3.0",
"38.2.0",
"35.8.0",
"38.1.0",
"38.0.0",
"38.0.0rc3",
"38.0.0rc2",
"38.0.0rc1",
"37.0.0",
"37.0.0rc4",
"37.0.0rc3",
"37.0.0rc2",
"37.0.0rc1",
"35.7.0",
"35.6.1",
"36.0.0",
"35.6.0",
"35.5.0",
"35.4.1",
"35.4.0",
"35.3.0",
"35.2.1",
"35.2.0",
"35.1.1",
"35.1.0",
"35.0.1",
"35.0.0",
"35.0.0rc2",
"35.0.0rc1",
"34.0.0",
"34.0.0rc2",
"34.0.0rc1",
"33.0.0",
"33.0.0rc3",
"33.0.0rc2",
"33.0.0rc1",
"32.0.0",
"32.0.0rc2",
"32.0.0rc1",
"1.31.0",
"1.30.0",
"1.30.0rc3",
"1.30.0rc2",
"1.30.0rc1",
"1.29.0rc1",
"1.29.0",
"1.29.0rc2",
"1.28.0",
"1.28.0rc2",
"1.28.0rc1",
"1.27.0rc2",
"1.27.0",
"1.27.0rc1",
"1.26.0",
"1.26.0rc2",
"1.26.0rc1",
"1.25.0",
"1.25.0rc2",
"1.25.0rc1",
"1.24.0",
"1.24.0rc1",
"1.23.0",
"1.22.8",
"1.22.7",
"1.22.6",
"1.22.5",
"1.22.4",
"1.22.4.dev1",
"1.22.2",
"1.22.3",
"1.22.1",
"1.22.0",
"1.21.12",
"1.21.11",
"1.21.10",
"1.21.9",
"1.21.8",
"1.21.7",
"1.21.6",
"1.21.5",
"1.21.4",
"1.21.3",
"1.21.2",
"1.21.1",
"1.21.0",
"1.20.8",
"1.20.7",
"1.20.6",
"1.20.5",
"1.20.4",
"1.20.4rc3",
"1.20.4rc2",
"1.20.4rc1",
"1.20.3",
"1.20.3rc2",
"1.20.3rc1",
"1.20.2",
"1.20.1",
"1.20.0",
"1.19.8",
"1.19.7",
"1.19.6",
"1.19.5",
"1.19.4",
"1.19.3",
"1.19.1",
"1.19.2",
"1.19.0",
"1.18.9",
"1.18.8",
"1.18.7",
"1.18.6",
"1.18.5",
"1.18.4",
"1.18.3",
"1.18.2",
"1.18.1",
"1.17.8",
"1.18.0",
"1.17.7",
"1.17.6",
"1.17.5",
"1.17.4",
"1.17.3",
"1.17.2",
"1.17.1",
"1.17.0",
"1.16.4",
"1.16.3",
"1.16.2",
"1.16.1",
"1.16.0",
"1.15.4",
"1.15.5",
"1.15.3",
"1.15.0",
"1.15.2",
"1.15.1",
"1.14.11",
"1.14.9",
"1.14.10",
"1.14.8",
"1.14.7",
"1.14.6",
"1.14.5",
"1.14.2",
"1.14.4",
"1.14.3",
"1.14.0.post1",
"1.14.1.post1",
"1.13.3",
"1.13.1",
"1.13.0",
"1.12.6",
"1.12.5",
"1.12.4",
"1.12.3",
"1.12.2",
"1.12.1",
"1.12.0",
"1.11.4",
"1.11.3",
"1.11.0",
"1.11.2",
"1.11.1",
"1.10.7",
"1.10.6",
"1.10.5",
"1.10.4",
"1.10.3",
"1.10.2",
"1.10.1",
"1.10.0",
"1.9.6",
"1.9.5",
"1.9.4",
"1.9.3",
"1.9.2",
"1.9.1",
"1.8.5",
"1.9.0",
"1.8.4",
"1.8.3",
"1.8.2",
"1.8.1",
"1.8.0",
"1.7.3",
"1.7.2",
"1.7.1",
"1.7.0",
"1.6.8",
"1.6.7",
"1.6.5",
"1.6.6",
"1.6.4",
"1.6.3",
"1.6.2",
"1.6.1",
"1.6.0",
"1.5.11",
"1.5.12",
"1.5.10",
"1.5.9",
"1.5.7",
"1.5.6",
"1.5.5",
"1.5.4",
"1.5.3",
"1.5.2",
"1.5.1",
"1.5.0",
"1.4.6",
"1.4.5",
"1.4.4",
"1.4.2",
"1.4.3",
"1.4.1",
"1.4.0",
"1.3.3",
"1.3.2",
"1.3.1.post1",
"1.3.1",
"1.3.0.post1",
"1.2.4",
"1.2.5",
"1.2.3",
"1.2.2",
"1.2.1",
"1.2.0",
"1.1.3",
"1.1.2",
"1.1.1",
"1.1.0",
"1.0.1",
"1.0.0",
"0.3.10",
"0.3.9",
"0.3.8",
"0.3.7",
"0.3.6",
"0.3.5",
"0.3.4",
"0.3.3",
"0.3.2",
"0.3.1",
"0.3.0",
"0.2.14",
"0.2.13",
"0.2.12",
"0.2.11",
"0.2.10",
"0.2.9",
"0.2.8",
"0.2.7",
"0.2.6",
"0.2.5",
"0.2.4",
"0.2.3",
"0.2.2",
"0.2.1",
"0.2.0",
"0.1.35",
"0.1.34",
"0.1.33",
"0.1.32",
"0.1.31",
"0.1.30",
"0.1.29",
"0.1.28",
"0.1.27",
"0.1.26",
"0.1.25",
"0.1.24",
"0.1.23",
"0.1.22",
"0.1.21",
"0.1.20",
"0.1.19",
"0.1.18",
"0.1.17",
"0.1.16",
"0.1.15",
"0.1.14",
"0.1.13",
"0.1.12",
"0.1.11",
"0.1.10",
"0.1.9",
"0.1.8",
"0.1.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25138.json"
}
}
],
"modified": "2026-10-28T02:30:32.733221270Z",
"provider": "osv",
"references": [
"https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages",
"https://github.com/rucio/rucio/releases/tag/35.8.3",
"https://github.com/rucio/rucio/releases/tag/38.5.4",
"https://github.com/rucio/rucio/releases/tag/39.3.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25138.json",
"https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9",
"https://nvd.nist.gov/vuln/detail/CVE-2026-25138"
],
"provider_metadata": {
"cwe_ids": [
"CWE-204"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25138.json"
}
},
"related_cves": [
{
"value": "CVE-2026-25138",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499873,
"published_at": "2026-02-25T19:28:35.628+00:00"
}