PT-2025-11691 · Beta80 · Beta80 Life 1St Identity Manager

Published 2025-03-19 · Updated 2025-03-19 · CVE-2025-26485

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beta80 Life 1st Identity Manager version 1.5.2.14234

Description The issue allows user enumeration using authentication REST APIs. Different error messages are returned for failed authentication attempts, depending on whether a wrong password or a non-existent user is used.

Recommendations For version 1.5.2.14234, consider modifying the authentication API to return generic error messages for all failed authentication attempts, rather than distinguishing between incorrect passwords and non-existent users, to prevent user enumeration.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-26485

Affected Products

Beta80 Life 1St Identity Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-26485 · Security Note
• https://t.me/cvedetector/20653 · Telegram Post
• https://t.me/cvetracker/19444 · Telegram Post
• https://twitter.com/CVEnew/status/1902387403299680300 · Twitter Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-26485 · Note
• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26485 · Note