CVE-2025-9824: Mautic Core User Enumeration via Response Timing Vulnerability
Summary
CVE-2025-9824: Mautic Vulnerable to User Enumeration via Response Timing. Affects mautic/core across 3 version ranges.
>= 4.4.0, < 4.4.17
>= 5.0.0-alpha, < 5.2.8
>= 6.0.0-alpha, < 6.0.5
Fixed in 4.4.17, 5.2.8 or 6.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns and customer relationships effectively. It provides features such as email marketing, lead management, and analytics. However, Mautic has been found to be vulnerable to a user enumeration issue due to inconsistent response times during login attempts, which can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the difference in response times when a valid username is provided versus an invalid one. When a valid username is entered, the system takes longer to respond due to password hashing, while an invalid username results in a quicker response. This timing discrepancy allows attackers to enumerate valid usernames and potentially launch brute force attacks. The vulnerability is classified under CWE-204, indicating a lack of protection against user enumeration.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.4.0, < 4.4.174.4.17composer require mautic/core:4.4.17 -
>= 5.0.0-alpha, < 5.2.85.2.8composer require mautic/core:5.2.8 -
>= 6.0.0-alpha, < 6.0.56.0.5composer require mautic/core:6.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are available for this vulnerability. The only recommended action is to upgrade to the patched version.
Conclusion
In summary, CVE-2025-9824 is a significant vulnerability in Mautic Core that can lead to user enumeration through timing attacks. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Regular monitoring and updates are essential to maintain the security of your applications.
See every vulnerability recorded for mautic/core →
FAQ
CVE-2025-9824 is a vulnerability in Mautic Core that allows attackers to enumerate valid usernames through response timing discrepancies during login attempts.
If exploited, this vulnerability can lead to unauthorized access attempts by allowing attackers to identify valid usernames and perform brute force attacks.
Versions 4.4.0 to 4.4.16, 5.0.0-alpha to 5.2.7, and 6.0.0-alpha to 6.0.4 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
