CVE-2025-26485

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-19 · updated 2026-06-17
Weakness: CWE-200

Description

A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong password or a non existent user). The difference in the returned error messages could be used by attackers to understand whether a certain user is registered in the Identity Manager. This issue affects Life 1st: 1.5.2.14234.

Affected products

Beta80 Life 1st: 1.5.2.14234

References

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26485
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26485

Get alerted when CVE-2025-26485 or the next vulnerability affects your stack