Login endpoint problems #119

New issue

Closed

opened 2026-02-05 00:39:26 +00:00 by kudyakovaa · 2 comments

kudyakovaa commented

2026-02-05 00:39:26 +00:00

(Migrated from git.csit.sgu.ru)

When sending a POST /api/v1/login request with the body {"email": "string", "password": "string"}, the server returns the following response:

{
  "title": "Internal Server Error",
  "status": 500,
  "detail": "user not found"
}

This behavior indicates two distinct vulnerabilities:

CWE-204 (Observable Response Discrepancy)
The server explicitly states that the user does not exist, rather than returning a generic "Invalid credentials" error. This facilitates User Enumeration, allowing attackers to verify which emails exist in the database and significantly reducing the complexity of password brute-force or credential stuffing attacks.
Information Disclosure (Leaking Internal Error State)
We are leaking the raw text from the internal Go error object directly to the client. This exposes the application's internal state. While it causes CWE-204 in this instance, this pattern could potentially leak even more sensitive information (e.g., database schema details or stack traces) in other scenarios.

DX Impact
Additionally, returning a 500 Internal Server Error for a logic error makes frontend integration difficult. The client cannot easily distinguish between a genuine server crash and a standard validation failure (incorrect credentials).

When sending a `POST /api/v1/login` request with the body `{"email": "string", "password": "string"}`, the server returns the following response: ```json { "title": "Internal Server Error", "status": 500, "detail": "user not found" } ``` This behavior indicates two distinct vulnerabilities: 1. **CWE-204 (Observable Response Discrepancy)** The server explicitly states that the user does not exist, rather than returning a generic "Invalid credentials" error. This facilitates User Enumeration, allowing attackers to verify which emails exist in the database and significantly reducing the complexity of password brute-force or credential stuffing attacks. 2. **Information Disclosure (Leaking Internal Error State)** We are leaking the raw text from the internal Go error object directly to the client. This exposes the application's internal state. While it causes CWE-204 in this instance, this pattern could potentially leak even more sensitive information (e.g., database schema details or stack traces) in other scenarios. **DX Impact** Additionally, returning a 500 Internal Server Error for a logic error makes frontend integration difficult. The client cannot easily distinguish between a genuine server crash and a standard validation failure (incorrect credentials).

kudyakovaa commented

2026-02-05 00:41:17 +00:00

(Migrated from git.csit.sgu.ru)

https://cwe.mitre.org/data/definitions/204.html