CVE-2025-50850 Details

A brute-force vulnerability has been identified in the vendor login functionality of CS-Cart version 4.18.3. The issue arises because the login endpoint lacks essential security measures such as CAPTCHA verification and rate limiting. This deficiency allows attackers to systematically try different combinations of usernames and passwords to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint vulnerable to automated attacks.

To address this vulnerability, it is recommended to implement CAPTCHA on vendor login forms, introduce account lockout thresholds or temporary delays after failed login attempts, and monitor for abnormal login activity and brute-force patterns.