CVE-2025-14243

MEDIUM

Mirror-registry: openshift mirror registry: user enumeration via authentication error messages

Title source: cna
STIX 2.1

Description

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation.

References (2)

Core 2
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-14243
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2419829
https://bugzilla.redhat.com/show_bug.cgi?id=2419829

Scores

CVSS v3 5.3
EPSS 0.0029
EPSS Percentile 20.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-209
Status published
Products (4)
Red Hat/mirror registry for Red Hat OpenShift
Red Hat/mirror registry for Red Hat OpenShift 2
redhat/mirror_registry_for_red_hat_openshift
redhat/mirror_registry_for_red_hat_openshift 2.0
Published Apr 08, 2026
Tracked Since Apr 08, 2026