AIKIDO-2025-10504
craftcms/cms is vulnerable to Observable Response Discrepancy
44
Medium Risk
This Affects:
craftcms/cmsTL;DR
Affected versions of the package are vulnerable to user account enumeration, even when the preventUserEnumeration setting is enabled. This flaw allows attackers to infer whether a user account exists based on differences in the application's response behavior, potentially enabling targeted attacks such as credential stuffing or phishing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
craftcms/cms is vulnerable to Observable Response Discrepancy in versions 4.0.0 - 4.16.6 and 5.0.0 - 5.8.9.
How to fix this
Upgrade the craftcms/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant