User Enumeration Vulnerability in Pega Platform by Pegasystems
CVE-2025-62181

5.3MEDIUM

Key Information:

Vendor

Pegasystems

Status
Pega Infinity
Vendor
CVE Published:
10 December 2025

What is CVE-2025-62181?

The Pega Platform is susceptible to a user enumeration vulnerability that arises during the user authentication process. This risk, present in versions 7.1.0 through Infinity 25.1.0, enables a remote unauthenticated user to exploit variations in response times, allowing them to infer whether a particular username is valid. The vulnerability pertains specifically to the deprecated basic authentication feature, underscoring the importance of utilizing more secure authentication methods. To address this issue, updates have been released in patch versions 24.1.4, 24.2.4, and 25.1.1, with the basic credentials service type being deprecated as of version 24.2.

Affected Version(s)

Pega Infinity 7.1.0

References

https://support.pega.com/support-doc/pega-security-adviso...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Kahlert from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/)
Louis Sohier of ENGIE IT Offensive Cybersecurity Team
.