Mautic User Enumeration Vulnerability in Password Reset Functionality

A user enumeration vulnerability has been identified in Mautic's password reset feature. This issue allows unauthenticated users to determine valid usernames by exploiting timing differences in response rates for existing versus non-existing users. The vulnerability arises from a lack of request limiting, enabling a timing-based attack to confirm username validity.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can identify valid usernames within the application.

Remediation

Users are advised to update to Mautic versions 6.0.2, 5.2.6, or 4.4.16, all of which address this vulnerability by normalizing password reset response times to ensure they are consistent, regardless of whether a username exists.