CVE-2025-62181

🗓️ 10 Dec 2025 20:41:08Reported by PegaType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Pega authentication timing flaw enables remote user enumeration; deprecated authentication; fixes in twenty four and twenty five one one.

Reporter	Title	Published	Views	Family All 9
CNNVD	Pega Platform 安全漏洞	10 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-62181 Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.	10 Dec 202520:41	–	cvelist
EUVD	EUVD-2025-202616	10 Dec 202521:31	–	euvd
NVD	CVE-2025-62181	10 Dec 202521:16	–	nvd
Packet Storm	📄 PEGA Infinity Brute Force / Insecure Direct Object Reference	20 Mar 202600:00	–	packetstorm
Positive Technologies	PT-2025-50493	10 Dec 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-62181: Observable Response Discrepancy	10 Dec 202500:00	–	rapid7
RedhatCVE	CVE-2025-62181	11 Dec 202520:53	–	redhatcve
Vulnrichment	CVE-2025-62181 Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.	10 Dec 202520:41	–	vulnrichment

[
  {
    "defaultStatus": "unaffected",
    "product": "Pega Infinity",
    "vendor": "Pegasystems",
    "versions": [
      {
        "lessThan": "Infinity 25.1.1",
        "status": "affected",
        "version": "7.1.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
support	www.support.pega.com/support-doc/pega-security-advisory-j25-vulnerability-remediation-note

Parameter	Position	Path	Description	CWE
UserIdentifier	request body	/XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD	Username enumeration via timing-based information leakage in the login endpoint.	CWE-204

28 Sep 2026 22:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.00441

SSVC