Dify User Enumeration via Observable Response Discrepancy

mediumseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.

Impact

Attackers can enumerate registered email addresses, potentially aiding further targeted attacks or phishing.

Fix

Update to version 1.9.0 or later.

How to confirm it

Send: POST /console/api/login
Positive when: contains "Account not found" AND contains in content_type "application/json" AND status 400

Run it with nuclei: nuclei -id CVE-2026-28288 -u <target>

The full check

id: CVE-2026-28288

info:
  name: Dify User Enumeration via Observable Response Discrepancy
  author: DhiyaneshDk
  severity: medium
  description: |
    Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
  impact: |
    Attackers can enumerate registered email addresses, potentially aiding further targeted attacks or phishing.
  remediation: |
    Update to version 1.9.0 or later.
  reference:
    - https://github.com/langgenius/dify/security/advisories/GHSA-9qpf-wcv3-w3qx
    - https://github.com/langgenius/dify/issues/24323
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-28288
    epss-score: 0.00689
    epss-percentile: 0.53065
    cwe-id: CWE-204
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,dify,user-enum,info-leak

http:
  - raw:
      - |
        POST /console/api/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"nonexistent{{randstr}}@example.com","password":"{{randstr}}","language":"en-US","remember_me":true}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Account not found"

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from