Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-11750— User Enumeration via Distinct Error Messages in langgenius/dify-web

Quick assessment

Affected
langgenius langgenius/dify
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

dify是LangGenius开源的一个开源的 LLM 应用程序开发平台。 dify 1.6.0版本存在安全漏洞，该漏洞源于身份验证机制对不存在的账户和现有账户返回不同的错误消息，可能导致账户枚举攻击。

AI Predicted 5.3 Difficulty: Trivial EPSS 0.70% · P52

Public Exploits 1

Nuclei · 1 CVE-2025-11750.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-11750

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
User Enumeration via Distinct Error Messages in langgenius/dify-web
Source: CVE Program / CVE List V5
Vulnerability Description
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
标准化错误处理机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
dify 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dify是LangGenius开源的一个开源的 LLM 应用程序开发平台。 dify 1.6.0版本存在安全漏洞，该漏洞源于身份验证机制对不存在的账户和现有账户返回不同的错误消息，可能导致账户枚举攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
langgenius langgenius/dify unspecified ~ latest -

II. Public POCs for CVE-2025-11750

# POC Description Source Link Shenlong Link
1 A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as "account_not_found" or "Account not found.", allowing attackers to identify valid accounts. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11750.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-11750

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-11750 (1)

IV. Related Vulnerabilities

Same product: langgenius/dify
Same vendor: langgenius
Same weakness: CWE-544

V. Comments for CVE-2025-11750

Anonymous User
2025-11-25 00:29:37

Hey

Leave a comment