PT-2025-50493 · Pega · Pega Platform

Eric Kahlert + 1 · Published 2025-12-10 · Updated 2026-03-19 · CVE-2025-62181

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pega Platform versions 7.1.0 through Infinity 25.1.0

Description Pega Platform is affected by a User Enumeration issue. A remote unauthenticated user could determine the validity of a username by observing differences in response times during the user authentication process. This issue is related to the deprecated basic-authentication feature, and more secure authentication mechanisms are recommended. The username parameter is involved in this process.

Recommendations Versions 7.1.0 through 24.1.3 require updating to version 24.1.4 or later. Versions 24.1.4 through 24.2.3 require updating to version 24.2.4 or later. Versions 24.2.4 through 25.1.0 require updating to version 25.1.1 or later. Consider disabling the basic-authentication feature and adopting more secure authentication mechanisms.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-62181

Affected Products

Pega Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-62181 · Security Note
• https://twitter.com/CVEnew/status/1999108944388878476 · Twitter Post
• https://support.pega.com/support-doc/pega-security-advisory-j25-vulnerability-remediation-note · Note
• https://twitter.com/autumn_good_35/status/2034536443880919408 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998984117875040598 · Twitter Post
• https://t.me/CVEtracker/39390 · Telegram Post