{"id":"CVE-2025-9824","aliases":["GHSA-3ggv-qwcp-j6xg"],"url":"https://o3.security/vulnerability/CVE-2025-9824","summary":"User Enumeration via Response Timing","details":"### Impact\nThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.\n\n### Patches\nThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.\n\n### Technical Details\nThe vulnerability was caused by different response times when:\n- A valid username was provided (password hashing occurred)\n- An invalid username was provided (no password hashing occurred)\n\nThe fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.\n\n### Workarounds\nNo workarounds are available. Users should upgrade to the patched version.\n\n### References\n- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account\n- https://github.com/mautic/mautic-security/pull/146","published":"2025-09-03T14:25:06.796Z","modified":"2026-08-12T03:51:26.654938848Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"mautic/core","fixedVersion":"4.4.17"},{"ecosystem":"Packagist","name":"mautic/core","fixedVersion":"5.2.8"},{"ecosystem":"Packagist","name":"mautic/core","fixedVersion":"6.0.5"}],"fix":{"url":"https://github.com/mautic/mautic/commit/6bc4f5f1aabb13df12714ad0ea9fc281cbb867c6","label":"mautic/mautic@6bc4f5f"},"references":[{"type":"WEB","url":"https://packagist.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9824.json"},{"type":"ADVISORY","url":"https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9824"},{"type":"PACKAGE","url":"https://github.com/mautic/mautic"},{"type":"WEB","url":"https://github.com/mautic/mautic/commit/6bc4f5f1aabb13df12714ad0ea9fc281cbb867c6"},{"type":"WEB","url":"https://github.com/mautic/mautic/commit/b4264c717ce31fbafafcefc04b02ecb9fb911e62"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:26.654938848Z"}}