AIKIDO-2026-10052

TL;DR

Affected versions of this package are vulnerable to a Predictable User ID Sequence vulnerability due to the use of sequential integers for user IDs, which makes it easy to guess valid IDs and estimate system user count. An attacker can exploit this by brute-forcing or iterating through possible IDs to enumerate user accounts, potentially leading to unauthorized access or data exposure. While UUIDs are now the default for dbAuth to mitigate this, developers can still switch to auto-incrementing integers, maintaining the risk if not properly configured.