CVE-2025-39665: Nagvis User Enumeration Vulnerability

CVE-2025-39665 Overview

CVE-2025-39665 is a user enumeration vulnerability in the NagVis CheckmkMultisiteAuth authentication module. Versions prior to 1.9.48 respond differently depending on whether a submitted username exists in the Checkmk backend. An unauthenticated remote attacker can leverage this observable discrepancy to enumerate valid Checkmk usernames over the network. The flaw is categorized under CWE-203: Observable Discrepancy. While the issue does not directly compromise integrity or availability, harvested usernames enable follow-on password spraying, credential stuffing, and targeted phishing against Checkmk operators.

Critical Impact
Unauthenticated attackers can enumerate valid Checkmk usernames through the NagVis authentication endpoint, providing reconnaissance data for credential-based attacks against monitoring infrastructure.

Affected Products

NagVis versions prior to 1.9.48
NagVis deployments using the CheckmkMultisiteAuth authentication backend
Checkmk environments integrated with vulnerable NagVis instances

Discovery Timeline

2025-12-03 - CVE-2025-39665 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39665

Vulnerability Analysis

NagVis is an open-source visualization add-on for Nagios and Checkmk monitoring platforms. The CheckmkMultisiteAuth module handles authentication against a Checkmk Multisite backend. In releases before 1.9.48, the module returns distinguishable responses based on whether the supplied username exists in Checkmk. An attacker interacting with the login endpoint can compare responses across a wordlist of candidate usernames and identify valid accounts.

User enumeration weaknesses do not by themselves grant access, but they materially lower attacker effort for follow-on authentication attacks. Valid usernames combined with password spraying or reused-credential attacks frequently produce successful logins against monitoring consoles, which often hold broad operational visibility. The fix landed in NagVis 1.9.48 per the project changelog and pull request #411 commit 4acabcf.

Root Cause

The root cause is an observable discrepancy in the authentication code path. The CheckmkMultisiteAuth implementation branches on whether the provided username matches an existing Checkmk account, and each branch produces a distinguishable outcome — for example, differing response content, error messaging, or timing. This behavior violates the principle that authentication failures should be indistinguishable regardless of which credential component is invalid.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends a series of authentication requests to the NagVis login interface using candidate usernames and observes which responses indicate account existence. No code is required beyond a scripted HTTP client iterating a username list against the login endpoint. See the vendor patch commit for the specific response-normalization changes.

Detection Methods for CVE-2025-39665

Indicators of Compromise

High-volume authentication attempts against NagVis login endpoints from a single source or small set of sources within a short window.
Sequential or dictionary-ordered username submissions to the NagVis authentication URL.
Web server logs showing repeated POST requests to NagVis login handlers with varying username parameters and identical or missing password values.

Detection Strategies

Monitor NagVis and Checkmk web logs for elevated failed-login rates and abnormal ratios of unique usernames per source IP.
Alert on request patterns exhibiting fixed timing intervals against authentication endpoints, which suggest automated enumeration.
Correlate NagVis authentication events with downstream Checkmk login attempts to identify enumeration-then-spray sequences.

Monitoring Recommendations

Ingest NagVis, Checkmk, and reverse-proxy access logs into a centralized SIEM for cross-source correlation.
Baseline normal authentication volume per source and generate alerts on statistically significant deviations.
Track authentication response codes and payload sizes to identify anomalous response patterns consistent with enumeration probes.

How to Mitigate CVE-2025-39665

Immediate Actions Required

Upgrade NagVis to version 1.9.48 or later, which normalizes authentication responses in the CheckmkMultisiteAuth module.
Restrict network access to NagVis administrative and login endpoints using firewall rules, VPN, or IP allowlisting.
Enforce strong, unique passwords and multi-factor authentication on all Checkmk accounts to blunt post-enumeration credential attacks.

Patch Information

The vendor released a fix in NagVis 1.9.48. Refer to the NagVis 1.9.48 changelog and the fix in pull request #411, commit 4acabcf. Administrators should validate the upgraded version and confirm that the CheckmkMultisiteAuth backend no longer produces distinguishable responses for valid versus invalid usernames.

Workarounds

Place NagVis behind an authenticating reverse proxy or web application firewall that enforces rate limiting on the login endpoint.
Apply strict source-IP restrictions to NagVis authentication URLs until the patch is applied.
Disable the CheckmkMultisiteAuth backend temporarily where operationally feasible and rely on an alternative authentication module.

bash

# Example nginx rate limit for NagVis login endpoint
limit_req_zone $binary_remote_addr zone=nagvis_login:10m rate=5r/m;

location /nagvis/server/core/ajax_handler.php {
    limit_req zone=nagvis_login burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://nagvis_backend;
}