CVE-2026-24664CWE-204

Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies

Medium · published February 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This issue has been patched in version 4.2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-02-03T16:56Z
EPSS history
Timeline
  • 03 FEB 16:56Z
    Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies
    cvelistv5