CVE-2025-26485CWE-200

A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong…

Medium · published March 19, 2025

CVSS v3.1
5.8
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts

(in case of the usage of a wrong password or a non existent user). The difference in the

returned error messages could be used by attackers to understand whether a

certain user is registered in the Identity Manager.

This issue affects Life 1st: 1.5.2.14234.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-03-19T15:27Z
EPSS history
Timeline
  • 19 MAR 15:27Z
    A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong…
    cvelistv5