{"id":"CVE-2024-24766","aliases":["GHSA-c967-2652-gfjm","GO-2024-2615"],"url":"https://o3.security/vulnerability/CVE-2024-24766","summary":"CasaOS Username Enumeration","details":"### Summary\n\nThe Casa OS Login page has disclosed the username enumeration vulnerability in the login page.\n\n### Details\n\nIt is observed that the attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error \"**User does not exist**\",  If the password is incorrect application gives the error \"**Invalid password**\". \n\n### PoC\n\nCapture the login request in a tool like Burp Suit and use the intruder tab for trying multiple usernames. \nKeep checking the response of each request if the response says **Invalid password** then the username is right.\n\n### Impact\n\nUsing this error attacker can enumerate the username of CasaOS. \n\n### The logic behind the issue\n\nIf the username is incorrect, then throw an error \"User does not exist\" else throw an error \"Invalid password\".\n\nThis condition can be vice versa like:\n\nIf the password is incorrect, then throw an error \"Invalid password\" else throw an error \"User does not exist\".\n\n### Mitigation\n\nSince this is the condition we have to implement a single error which can be \"Username/Password is Incorrect!!!\"\n\n\n\n","published":"2024-03-06T18:10:25.869Z","modified":"2026-08-12T03:51:44.566520882Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/IceWhaleTech/CasaOS-UserService","fixedVersion":"0.4.7"}],"fix":{"url":"https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7","label":"IceWhaleTech/CasaOS-UserService@c75063d"},"references":[{"type":"WEB","url":"https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24766.json"},{"type":"ADVISORY","url":"https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm"},{"type":"ADVISORY","url":"https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-hcw2-2r9c-gc6p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24766"},{"type":"FIX","url":"https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7"},{"type":"PACKAGE","url":"https://github.com/IceWhaleTech/CasaOS-UserService"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.566520882Z"}}