CVE-2025-13736 in API Manager
Summary
by MITRE • 08/06/2026
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the validate_username configuration.
The discovery of valid usernames can increase the risk of brute force attacks, social engineering attacks, and targeted information leakage. Attackers can leverage this information to craft more effective phishing campaigns or social engineering tactics to compromise user accounts or extract sensitive data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability represents a critical information disclosure flaw that undermines the security posture of authentication systems by enabling account enumeration attacks. The issue manifests when multi-attribute login functionality is activated, creating inconsistent behavior in the login interface's response handling for user credentials. The system exhibits a clear distinction between valid and invalid user accounts through its response patterns, where legitimate users trigger canonical username resolution while non-existent accounts simply echo back the original input provided by the attacker. This inconsistency directly violates fundamental security principles of authentication system design, as it provides attackers with actionable intelligence about account validity without requiring successful authentication attempts.
The technical implementation flaw stems from improper handling of user validation responses within the authentication pipeline, creating a side-channel information leak that operates independently of traditional security controls. When validate_username configuration is ignored or overridden by the multi-attribute login mechanism, the system fails to maintain consistent error messaging patterns across all authentication attempts. This behavior aligns with CWE-204, which addresses information exposure through inconsistent error messages, and represents a specific instance of weak credential handling that enables account enumeration attacks. The vulnerability operates at the application layer and can be classified under ATT&CK technique T1078.004 for valid accounts, as it provides adversaries with confirmed user identities that can then be targeted for further exploitation.
The operational impact of this vulnerability extends far beyond simple information disclosure, creating multiple attack vectors that significantly increase the probability of successful account compromise. Attackers can systematically enumerate valid usernames through repeated login attempts, building comprehensive lists of active accounts that can be used to focus brute force attacks on known user identities rather than random username combinations. This enumeration capability dramatically reduces the computational complexity and time required for credential guessing attacks, making automated attack tools far more effective against the system. The information leakage also enables sophisticated social engineering campaigns where attackers can craft highly targeted phishing messages using confirmed usernames, increasing the likelihood of successful deception and account takeover.
The implications for security operations are severe, as this vulnerability undermines the effectiveness of defense-in-depth strategies that rely on authentication system integrity to prevent unauthorized access. Organizations implementing multi-attribute login features must recognize that proper input sanitization and consistent error handling are essential security controls that cannot be bypassed by configuration settings. The vulnerability creates a situation where legitimate security measures like account lockout policies become less effective because attackers can first identify valid accounts before attempting to compromise them, effectively eliminating the element of surprise that these protections typically rely upon.
Mitigation strategies should focus on implementing consistent authentication response patterns regardless of account validity status, ensuring that all login attempts produce identical error messages or behaviors. This approach aligns with security best practices outlined in NIST SP 800-63B and ISO/IEC 29115 standards for authentication system design. Organizations should disable or carefully configure multi-attribute login features when account enumeration risks are not adequately mitigated through additional controls such as rate limiting, IP address monitoring, and behavioral analytics. The implementation of proper logging and monitoring for suspicious authentication patterns becomes critical to detect potential enumeration attempts, while security awareness training should emphasize the dangers of information leakage in authentication systems. Additionally, regular security testing including authenticated vulnerability assessments specifically targeting credential handling behaviors should be conducted to identify similar issues in custom authentication implementations or third-party solutions that may exhibit comparable weaknesses in their account validation processes.