Pega Platform User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Pega Platform versions 7.1.0 through 25.1.0. This issue arises during the user authentication process, where variations in response times may allow a remote, unauthenticated user to ascertain the validity of usernames. The vulnerability is limited to the deprecated basic authentication feature, with more secure authentication methods recommended. Patches for this vulnerability are included in the 24.1.4, 24.2.4, and 25.1.1 releases.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can differentiate between valid and invalid usernames based on response times during the authentication process.

Remediation

Users can upgrade to Pega Platform versions 24.1.4, 24.2.4, or 25.1.1 to address this vulnerability. Information about the availability of these patch releases will be publicly posted on the Pega Support Center on December 10, 2025.