User Enumeration

🗓️ 03 Oct 2025 05:22:01Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

Mautic core is vulnerable to user enumeration via timing between valid and invalid usernames.

Reporter	Title	Published	Views	Family All 12
CNNVD	Mautic 安全漏洞	3 Sep 202500:00	–	cnnvd
CVE	CVE-2025-9824	3 Sep 202514:25	–	cve
Cvelist	CVE-2025-9824 User Enumeration via Response Timing	3 Sep 202514:25	–	cvelist
EUVD	EUVD-2025-26524	3 Oct 202520:07	–	euvd
Github Security Blog	Mautic Vulnerable to User Enumeration via Response Timing	3 Sep 202522:20	–	github
NVD	CVE-2025-9824	3 Sep 202515:15	–	nvd
OSV	CVE-2025-9824	3 Sep 202515:15	–	osv
OSV	GHSA-3GGV-QWCP-J6XG Mautic Vulnerable to User Enumeration via Response Timing	3 Sep 202522:20	–	osv
Positive Technologies	PT-2025-35774	3 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-9824	5 Sep 202515:22	–	redhatcve

Vulners

Node

core mautic/coreRange6.0.0-alpha–6.0.4php

OR

core mautic/coreRange5.0.0-alpha–5.2.7php

OR

core mautic/coreRange4.4.0-beta–4.4.16php

OR

core mautic/coreMatch4.4.0php

OR

core mautic/coreMatch4.4.1php

OR

core mautic/coreMatch4.4.10php

OR

core mautic/coreMatch4.4.11php

OR

core mautic/coreMatch4.4.12php

OR

core mautic/coreMatch4.4.13php

OR

core mautic/coreMatch4.4.2php

OR

core mautic/coreMatch4.4.3php

OR

core mautic/coreMatch4.4.4php

OR

core mautic/coreMatch4.4.5php

OR

core mautic/coreMatch4.4.6php

OR

core mautic/coreMatch4.4.7php

OR

core mautic/coreMatch4.4.8php

OR

core mautic/coreMatch4.4.9php

OR

core mautic/coreMatch5.0.0php

OR

core mautic/coreMatch5.0.0-alphaphp

OR

core mautic/coreMatch5.0.0-alpha1php

OR

core mautic/coreMatch5.0.0-beta1php

OR

core mautic/coreMatch5.0.0-beta2php

OR

core mautic/coreMatch5.0.0-rc1php

OR

core mautic/coreMatch5.0.0-rc2php

OR

core mautic/coreMatch5.0.1php

OR

core mautic/coreMatch5.0.2php

OR

core mautic/coreMatch5.0.3php

OR

core mautic/coreMatch5.0.4php

OR

core mautic/coreMatch5.1.0php

OR

core mautic/coreMatch5.1.1php

OR

core mautic/coreMatch5.2.0php

OR

core mautic/coreMatch5.2.1php

OR

core mautic/coreMatch5.2.2php

OR

core mautic/coreMatch5.2.3php

OR

core mautic/coreMatch5.2.4php

OR

core mautic/coreMatch5.2.5php

OR

core mautic/coreMatch5.2.6php

OR

core mautic/coreMatch6.0.0php

OR

core mautic/coreMatch6.0.0-alphaphp

OR

core mautic/coreMatch6.0.0-beta2php

OR

core mautic/coreMatch6.0.0-rcphp

OR

core mautic/coreMatch6.0.1php

OR

core mautic/coreMatch6.0.2php

OR

core mautic/coreMatch6.0.3php

OR

core mautic/coreRange4.4.0–4.4.16php

Source	Link
github	www.github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg
github	www.github.com/mautic/mautic/commit/6bc4f5f1aabb13df12714ad0ea9fc281cbb867c6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-9824
github	www.github.com/mautic/mautic/commit/b4264c717ce31fbafafcefc04b02ecb9fb911e62
github	www.github.com/mautic/mautic

03 Jun 2026 10:03Current

7High risk

Vulners AI Score7

CVSS 3.15.9

EPSS0.00076

SSVC

mautic core user enumeration timing attack valid username invalid username brute force