christbowel/cve-2026-25050Proof-of-concept exploit for CVE-2026-25050, a timing attack enabling user enumeration via GraphQL authentication. Measures response times to identify existing accounts, facilitating targeted attacks.
This repository contains a Proof of Concept demonstrating a timing attack affecting the NativeAuthenticationStrategy.authenticate() method.
This PoC is provided as a technical demonstration for blog / research purposes.
The authentication logic returns immediately when a user does not exist, while performing a costly password hash verification when the user exists.
const user = await this.userService.getUserByEmailAddress(ctx, data.username);
if (!user) {
return false;
}
const passwordMatch = await this.verifyUserPassword(ctx, user.id, data.password);
This creates a measurable timing difference between authentication attempts for existing and non-existing users.
By measuring response times over multiple requests, an attacker can reliably determine whether a username (email address) exists.
This PoC performs multiple authentication attempts per username and computes the average response time to classify accounts as:
python3 exploit.py -u http://target.tld -w users.txt
The tool automatically appends the vulnerable endpoint:
/admin-api?languageCode=en
-u, --url Base target URL
-w, --wordlist Username / email wordlist
--silent Silent mode (progress + valid users only)
--shuffle Shuffle wordlist before testing
--delay MIN:MAX Random delay between requests (ms)
--resume state.json Resume a previous scan
--json results.json Export results to JSON
--delay helps avoid detection and rate-limiting.This proof of concept is provided for authorized security testing and educational purposes only. The author assumes no responsibility for misuse.