CVE-2025-27451CWE-204

CVE-2025-27451

Medium · published July 3, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-07-03T11:27Z
EPSS history
Timeline
  • 03 JUL 11:27Z
    CVE-2025-27451
    cvelistv5