Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
Ibexa User Login Reveals User Account Existence
published 1 year ago
Summary
Ibexa's user login system in version 5 inadvertently disclosed whether a user account existed or not. This could have helped attackers guess valid usernames. Ibexa has fixed this issue in updated versions. Update to a patched version to prevent potential attacks.
What to do
- Update ibexa user to version 5.0.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | ibexa | user |
>= 5.0.0, < 5.0.3 Fix: upgrade to 5.0.3
|
Original advisory text
ibexa/user login enumerates user accounts
### Impact
In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.
### Patches
See "Patched versions".
### Workarounds
None.
### Resources
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.
### Patches
See "Patched versions".
### Workarounds
None.
### Resources
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published17 Oct 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-q3x8-6898-23g3 · GHSA
Track software like this
Free during beta