---
id: CVE-2022-39228
aliases:
  - GHSA-36gx-9q6h-g429
  - PYSEC-2023-52
title: vantage6 vulnerable to Observable Response Discrepancy
summary: vantage6 vulnerable to Observable Response Discrepancy
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
vendor: vantage6
product: vantage6
ecosystem: pip
affected:
  - vantage6 < 3.8.0
patched:
  - vantage6 3.8.0
published: '2023-02-28'
updated: '2026-07-09'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-36gx-9q6h-g429'
references:
  - url: >-
      https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-39228'
  - url: 'https://github.com/vantage6/vantage6/issues/59'
  - url: 'https://github.com/vantage6/vantage6/pull/281'
  - url: >-
      https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-313.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml
  - url: 'https://github.com/vantage6/vantage6'
tags:
  - osv
  - pip
epss: 0.00596
epssPercentile: 0.46142
ingestedAt: '2026-07-09T18:56:35.143Z'
---

## Overview

### Impact
We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.

### Patches
Update to 3.8.0+

### Workarounds
No

### References
https://github.com/vantage6/vantage6/issues/59

### For more information
If you have any questions or comments about this advisory:
* Email us at [vantage6@iknl.nl](mailto:vantage6@iknl.nl)

## Affected packages

- `vantage6 < 3.8.0`

## Remediation

Upgrade to a patched release:

- `vantage6 3.8.0`