CVE-2025-65899

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism

Medium · published December 4, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Published
2025-12-04T00:00Z
EPSS history
Timeline
  • 04 DEC 00:00Z
    Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism
    cvelistv5