CVE-2025-13736

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description When Multi-Attribute Login is enabled, the login interface does not consistently mask the existence of user accounts. The server resolves and displays the canonical username for valid users, but echoes the original input for non-existent users, regardless of the validate username configuration. This behavior allows for the discovery of valid usernames, which can facilitate brute force attacks, social engineering, and targeted information leakage, enabling attackers to craft more effective phishing campaigns to compromise accounts or extract sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.