{"id":"CVE-2026-11960","kind":"vulnerability","aliases":["CVE-2026-11960"],"related":[],"title":"FacturaScripts: login responses reveal which usernames exist","description":"Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.","summary":"FacturaScripts version 2025.61 answers a login attempt differently for valid and invalid usernames, through error messages, timing or HTTP status. An unauthenticated attacker can use this to build a list of real accounts for brute-force, password spraying or phishing.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["facturascripts","package","php","self-hosted"],"not_affected_if":["auth-required","network-restricted"],"how_to_check":"- Confirm the installed version (`2025.61`) in the FacturaScripts admin panel or the project's version file\n- Send two login attempts, one with a known-valid username and one with a made-up username, and compare the error text, status code and response time","fix":null,"status":"open","published_at":"2026-10-20T09:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:38+00:00","updated_at":"2026-10-25T03:40:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FacturaScripts: login responses reveal which usernames exist","impact":"low","summary":"FacturaScripts version 2025.61 answers a login attempt differently for valid and invalid usernames, through error messages, timing or HTTP status. An unauthenticated attacker can use this to build a list of real accounts for brute-force, password spraying or phishing.","category":"package","nicknames":[],"who_cares":["facturascripts","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker gets a list of valid usernames for later attacks","analyst_note":"Find the fixed FacturaScripts version and the vendor advisory on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-11960) to fill in fix and how_to_check.","how_to_check":"- Confirm the installed version (`2025.61`) in the FacturaScripts admin panel or the project's version file\n- Send two login attempts, one with a known-valid username and one with a made-up username, and compare the error text, status code and response time","needs_analyst":true,"not_affected_if":["auth-required","network-restricted"],"who_is_affected":"Any FacturaScripts 2025.61 instance reachable from the network with a login form exposed. Installations behind a VPN or with the login page restricted to trusted addresses carry less exposure. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3403,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11960':10A,13A '-2026':9A,12A '2025.61':22B,68C 'account':52B,133C,158C 'allow':123C 'answer':23B 'applic':70C,101C 'attack':42B,90C,125C,146C 'attempt':26B,75C 'brute':55B,144C 'brute-forc':54B,143C 'build':47B 'campaign':154C 'carri':140C 'chang':106C 'code':119C 'compar':83C 'compil':127C 'confirm':157C 'could':91C,136C 'credenti':149C 'cve':8A,11A 'differ':27B,72C,115C 'discrep':110C 'engin':153C 'enumer':61C 'error':34B,112C 'examin':97C 'exist':7A 'exploit':122C 'facturascript':1A,14B,20B,66C 'forc':56B,145C 'host':19B 'http':38B,117C 'identifi':93C 'invalid':31B,86C 'list':49B,129C,135C 'log':77C 'login':2A,25B 'messag':35B,113C 'one':87C 'packag':15B 'password':57B,147C 'phish':60B 'php':16B 'real':51B 'respons':3A,73C,103C,108C 'return':71C 'reveal':4A 'self':18B 'self-host':17B 'social':152C 'spray':58B,148C 'status':39B,118C 'stuf':150C 'success':121C 'systemat':92C 'target':142C 'time':36B,109C 'unauthent':41B,63C,89C 'use':44B,138C 'user':64C,132C 'usernam':6A,32B,82C,95C 'valid':29B,81C,94C,131C 'variat':98C 'version':21B,67C","nicknames":[],"mitigations":[],"who_affected":"Any FacturaScripts 2025.61 instance reachable from the network with a login form exposed. Installations behind a VPN or with the login page restricted to trusted addresses carry less exposure. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11960","severity":null,"published_at":"2026-10-20T09:17:09+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}