CVE-2025-58586
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Risk Assessment
An attacker can enumerate valid usernames, facilitating further attacks (e.g., brute force or phishing). Impact concerns the confidentiality of account information.
Recommendation
Change login error messages to a uniform message regardless of the failure cause to prevent username enumeration.
Other vulnerabilities in Aplikacja (nieokreślona)
See all- CVE-2025-58591Medium
A remote, unauthorized attacker can brute force folders and files and read them, such as private keys or configurations, making the application vulnerable to gathering sensitive information.
- CVE-2025-58587Medium
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
Original NVD description (English source)
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS