AIKIDO-2025-10837

TL;DR

Affected versions of this package are vulnerable to information leakage due to login error messages that allow user enumeration by distinguishing between non-existing users and invalid passwords, exposure of release drafts to non-writer users, and API responses that reveal signature email addresses instead of user profile emails. An attacker can exploit this by analyzing error messages to enumerate valid usernames for targeted attacks, accessing sensitive draft release information without authorization, and harvesting email addresses through API calls for phishing or spam campaigns.