PT-2025-43031 · Dify-Web · Dify-Web

Published 2025-10-22 · Updated 2025-10-30 · CVE-2025-11750

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions langgenius/dify-web version 1.6.0

Description The authentication process in the software reveals whether user accounts exist by providing different error messages depending on whether a username or email is registered. Attempting to log in or register with a non-existent account results in an error message like "account not found," while a valid account with an incorrect password returns a different message. This allows attackers to enumerate valid user accounts by analyzing the error responses, potentially enabling targeted social engineering, brute force, or credential stuffing attacks. The API endpoint involved in this issue is the login API. The username or email parameters are used to identify accounts.

Recommendations For langgenius/dify-web version 1.6.0, ensure that the error messages returned during authentication do not differentiate between non-existent and existing accounts. Implement a consistent error message for invalid login attempts to prevent user enumeration.

Exploit

Fix

Weakness Enumeration

CWE-544

Related Identifiers

CVE-2025-11750

Affected Products

Dify-Web

References · 5

• 🔥 https://huntr.com/bounties/e7359f9f-c004-4304-9de9-753622d370a1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11750 · Security Note
• https://t.me/cveNotify/141010 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1980876806199865517 · Twitter Post