https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T10:11:29.273055+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-188473 EUVD-2026-188473 2026-10-08T10:11:29.320905+00:00 EUVD-2026-188473 https://cve.radiocsirt.org/vuln/fkie_cve-2024-47059 fkie_cve-2024-47059 2026-10-08T10:11:29.320948+00:00

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.

 https://cve.radiocsirt.org/vuln/ghsa-8vff-35qm-qjvv GHSA-8vff-35qm-qjvv — Mautic allows users enumeration due to weak password login 2026-10-08T10:11:29.320990+00:00

Affected: Packagist: mautic/core

### Summary

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.

### Patches

Update to 5.1.1 or later.

If you have any questions or comments about this advisory:

Email us at [security@mautic.org](mailto:security@mautic.org)