Account Enumeration Vulnerability in Mautic by Mautic Inc.

CVE-2025-9824

What is CVE-2025-9824?

An account enumeration vulnerability exists in Mautic, allowing attackers to discern valid usernames based on the response time of login attempts. When a valid username is submitted, the system takes longer due to password hashing, while invalid usernames yield a quicker response, revealing their non-existence. This discrepancy can be exploited to compile lists of valid usernames for subsequent brute force attacks. The vulnerability has been mitigated through the introduction of a TimingSafeFormLoginAuthenticator, which maintains consistent response times by executing a dummy password hash check regardless of username validity. Users are encouraged to upgrade to the most recent patched version to secure their accounts.

References