# CVE-2026-25597: prestashop — Fixed in 9.0.3 🐘 🐘 Packagist Not in CISA KEV MEDIUM severity # CVE-2026-25597 — prestashop MEDIUM CVE-2026-25597 is a medium-severity (CVSS 5.3) CWE-208 vulnerability in prestashop/prestashop. A fix is available for prestashop/prestashop — see the affected versions and patch details below. PrestaShop has a time based enumeration in FO login form Also known as[GHSA-67v7-3g49-mxh2](/vulnerability/GHSA-67v7-3g49-mxh2) Published Feb 6, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25597. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk\-0.00% Lower risk than most CVEs24th percentile — riskier than 24% of all scored CVEsHighest risk 0.00%0.27%0.54%0.82%0.3%0.3%0.3%Jul 26Nov 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 2 pkgs affected 🐘`prestashop/prestashop`🐘`prestashop/prestashop` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3. ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `prestashop/prestashop` ≥ 9.0.0-alpha.1&&< 9.0.3 9.0.3`composer require prestashop/prestashop:^9.0.3` 🐘Packagist `prestashop/prestashop` all versions 8.2.4`composer require prestashop/prestashop:^8.2.4` ## Affected Products 1 product · 2 configurations Application `prestashop`prestashop ≥ 9.0.0 && < 9.0.3 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for prestashop/prestashop, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update prestashop/prestashop to 9.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25597 is resolved across your whole dependency graph. 3. ### Workarounds If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. ## Frequently Asked Questions PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3. O3 Security · Impact-Aware SCA ### Is CVE-2026-25597 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)