5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9824

CVE-2025-9824: Mautic Vulnerable to User Enumeration via Response Timing

Impact

The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.

Patches

This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.

Technical Details

The vulnerability was caused by different response times when:

A valid username was provided (password hashing occurred)
An invalid username was provided (no password hashing occurred)

The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

Workarounds

No workarounds are available. Users should upgrade to the patched version.

References

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
https://github.com/mautic/mautic-security/pull/146

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9824

CVE-2025-9824:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mautic/core	composer	>= 4.4.0, < 4.4.17	4.4.17
mautic/core	composer	>= 5.0.0-alpha, < 5.2.8	5.2.8
mautic/core	composer	>= 6.0.0-alpha, < 6.0.5	6.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a user enumeration timing attack. The response time for a login attempt differed depending on whether the user existed or not, because password hashing was only performed for valid users. An attacker could abuse this timing difference to confirm the existence of usernames.

The patch addresses this by introducing a new authenticator, Mautic\UserBundle\Security\TimingSafeFormLoginAuthenticator. This class decorates the original form login authenticator.

The key change is in the authenticate method of this new class. It wraps the user loading process in a try-catch block. If a UserNotFoundException is caught (meaning the user does not exist), it proceeds to perform a dummy password hash verification using a hardcoded hash. This ensures that the execution time is similar for both existing and non-existing users, thus mitigating the timing attack vector.

The identified function, Mautic\UserBundle\Security\TimingSafeFormLoginAuthenticator::authenticate, is the direct implementation of the fix and is the function that would now appear in a runtime profile during a login attempt. While this function itself is the patch, it is the most critical function to be aware of in the context of this vulnerability, as its presence indicates that the system is patched.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.