{"id":"GHSA-q3x8-6898-23g3","aliases":[],"url":"https://o3.security/vulnerability/GHSA-q3x8-6898-23g3","summary":"ibexa/user login enumerates user accounts","details":"### Impact\nIn v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.\n\n### Patches\nSee \"Patched versions\".\n\n### Workarounds\nNone.\n\n### Resources\nhttps://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","published":"2025-10-17T17:58:08Z","modified":"2025-10-17T18:16:40.113403Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"ibexa/user","fixedVersion":"5.0.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ibexa/user/security/advisories/GHSA-q3x8-6898-23g3"},{"type":"WEB","url":"https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office"},{"type":"PACKAGE","url":"https://github.com/ibexa/user"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-17T18:16:40.113403Z"}}