CVE-2025-14243

MEDIUM

Mirror-registry: openshift mirror registry: user enumeration via authentication error messages

Title source: cna

Description

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation.

References (2)

[Vdb Entry, X_Refsource_Redhat] https://access.redhat.com/security/cve/CVE-2025-14243

[Issue Tracking, X_Refsource_Redhat] https://bugzilla.redhat.com/show_bug.cgi?id=2419829

Scores

CVSS v3 5.3

EPSS 0.0007

EPSS Percentile 21.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-209

Status published

Products (4)

Red Hat/mirror registry for Red Hat OpenShift

Red Hat/mirror registry for Red Hat OpenShift 2

redhat/mirror_registry_for_red_hat_openshift

redhat/mirror_registry_for_red_hat_openshift 2.0

Published Apr 08, 2026

Tracked Since Apr 08, 2026