BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-04

Assigner: Checkmk GmbH

Description

User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-39665

Affected Vendors & Products

Vendor	Product	Version / Range
nagvis	nagvis	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Impact Analysis

The vulnerability can impact you by allowing attackers to gather valid usernames without authentication, which can be used as a first step in targeted attacks such as brute force or phishing, potentially leading to unauthorized access.

Executive Summary

This vulnerability is a user enumeration issue in Nagvis' Checkmk MultisiteAuth before version 1.9.48. It allows an unauthenticated attacker to discover valid Checkmk usernames by exploiting the authentication mechanism.

Hi! I’m here to help you understand CVE-2025-39665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70