CVE-2026-54739

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

• CWE-204

• https://github.com/LemmyNet/lemmy/commit/4d235a1b668b7dda6b73dbbc9ca289bb40acfa83
• https://github.com/LemmyNet/lemmy/commit/59e968a5ac36d36d08a59028e2dbb92641536964
• https://github.com/LemmyNet/lemmy/pull/6531
• https://github.com/LemmyNet/lemmy/pull/6535
• https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
• https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-beta.1
• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xgg7-8hvq-8m65
• https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54733The Microsoft 365 and Microsoft Entra ID Plugins for Moodle …9.3
• CVE-2026-54734Prebid Server Java is the Java version of Prebid Server. Pri…10
• CVE-2026-54735Prebid Server is an open-source solution for running real-ti…10
• CVE-2026-54736Phalcon is a high-performance, full-stack PHP framework. Pri…8.2
• CVE-2026-54737@phun-ky/defaults-deep is a library like lodash defaultsDeep…7.3
• CVE-2026-54738Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-5474A vulnerability was found in NASA cFS up to 7.0.0. This affe…8.8
• CVE-2026-54740Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-54741Lemmy is a link aggregator and forum for the fediverse. Prio…5.3
• CVE-2026-54742Lemmy is a link aggregator and forum for the fediverse. From…5.1
• CVE-2026-54743Lemmy is a link aggregator and forum for the fediverse. Prio…6.4
• CVE-2026-54745Kubeflow Pipelines enables users to build and deploy portabl…10