CVE-2025-9824
published 2025-09-03CVE-2025-9824: ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.26%
17.7th percentile
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.
PatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.
Technical DetailsThe vulnerability was caused by different response times when:
* A valid username was provided (password hashing occurred)
* An invalid username was provided (no password hashing occurred)
The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.
WorkaroundsNo workarounds are available. Users should upgrade to the patched version.
References * https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mautic | core | >= 4.4.0 < 4.4.17 | 4.4.17 |
| mautic | core | >= 5.0.0-alpha < 5.2.8 | 5.2.8 |
| mautic | core | >= 6.0.0-alpha < 6.0.5 | 6.0.5 |
| mautic | mautic | >= >= 4.4.0 < < 4.4.17 | < 4.4.17 |
| mautic | mautic | >= >= 5.0.0-alpha < < 5.2.8 | < 5.2.8 |
| mautic | mautic | >= >= 6.0.0-alpha < < 6.0.5 | < 6.0.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mautic Vulnerable to User Enumeration via Response Timing
osv·2025-09-03
CVE-2025-9824 [MEDIUM] Mautic Vulnerable to User Enumeration via Response Timing
Mautic Vulnerable to User Enumeration via Response Timing
### Impact
The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.
### Patches
This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.
### Technical Details
The vulnerability was caused by different response times when:
- A valid username was provided (password hashing occurred)
- An invalid username was provided (no password hashing occurred)
The fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent us
GHSA
Mautic Vulnerable to User Enumeration via Response Timing
ghsa·2025-09-03
CVE-2025-9824 [MEDIUM] CWE-204 Mautic Vulnerable to User Enumeration via Response Timing
Mautic Vulnerable to User Enumeration via Response Timing
### Impact
The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.
### Patches
This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.
### Technical Details
The vulnerability was caused by different response times when:
- A valid username was provided (password hashing occurred)
- An invalid username was provided (no password hashing occurred)
The fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent us
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-03
Published