Tibbo AggreGate Network Manager Login Discrepancy User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Tibbo AggreGate Network Manager versions prior to 6.40.05. The issue arises from an observable response discrepancy in the login process, where authentication failure messages vary depending on the existence of the supplied username. This allows an unauthenticated remote attacker to infer valid account identifiers, potentially leading to targeted brute-force or credential-stuffing attacks.

Impact

Exploitation of this vulnerability could allow for user enumeration, increasing the risk of targeted brute-force or credential-stuffing attacks.