CVE-2025-62236CWE-204

CVE-2025-62236

Medium · published October 24, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-10-24T00:15Z
Affected products (1)
ProductVersionsFixed in
flyfrontier/frontier_airlinesall versions—
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-296-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-62236 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 23 OCT 19:31Z
    Frontier Airlines publicly available email address validation
    cvelistv5