CVE-2025-26485

Published: Mar 19, 2025Modified: Jun 17, 2026Deferred

5.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Secondary)

Description

A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong password or a non existent user). The difference in the returned error messages could be used by attackers to understand whether a certain user is registered in the Identity Manager. This issue affects Life 1st: 1.5.2.14234.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26485

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26485

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Timeline

No history available yet.