CVE-2025-49187CWE-204

User enumeration

Medium · published June 12, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 33.9th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-06-12T13:29Z
EPSS history
Timeline
  • 12 JUN 13:29Z
    User enumeration
    cvelistv5