AIKIDO-2025-10288
Umbraco.Cms is vulnerable to Observable Response Discrepancy
51
Medium Risk
This Affects:
Umbraco.CmsTL;DR
Affected versions of the package are vulnerable to observable response discrepancy. By analyzing the timing of post-login API responses, an attacker can infer the existence of user accounts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
Umbraco.Cms is vulnerable to Observable Response Discrepancy in versions 11.0.0 - 13.8.0 and 9.0.0 - 10.8.9.
How to fix this
Upgrade the Umbraco.Cms library to the patch version.
Links
GitHub Release
Fix Commits
github.com/umbraco/Umbraco-CMS/commit/14fbd20665b453cbf094ccf4575b79a9fba07e03github.com/umbraco/Umbraco-CMS/commit/34709be6cce9752dfa767dffbf551305f48839bc
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.