Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.
CVE-2025-65899
CVSS base score
5.3 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-204
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
difuse kalmia
References
- github.com Product
- github.com Exploit, Third Party Advisory