Beta80 Life 1st Identity Manager User Enumeration Vulnerability via Authentication REST APIs

A vulnerability allowing user enumeration has been identified in Beta80 Life 1st Identity Manager version 1.5.2.14234. This issue arises from the authentication REST APIs, which return different error messages for failed login attempts, depending on whether the password is incorrect or the username does not exist. This discrepancy can be exploited by unauthorized actors to determine the validity of user accounts.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can identify registered users in the system by analyzing the response messages from authentication attempts.