CVE-2025-54129 Overview
CVE-2025-54129 is a user enumeration vulnerability in HAXiam, a packaging wrapper for HAXcms that enables users to spawn microsite management platforms. Versions 11.0.4 and below return distinct HTTP responses depending on whether a queried user account exists. The application returns HTTP 200 for valid users and HTTP 404 for invalid users. Authenticated attackers can exploit this response discrepancy to enumerate valid accounts through automated tooling. The issue is tracked under [CWE-204: Observable Response Discrepancy] and fixed in version 11.0.5.
Critical Impact
Authenticated attackers can enumerate valid HAXiam user accounts and combine this information with other authorization flaws to deface other users' sites.
Affected Products
- HAXiam versions 11.0.4 and below
- HAXcms deployments packaged via HAXiam
- Microsite instances managed through affected HAXiam versions
Discovery Timeline
- 2025-07-21 - CVE-2025-54129 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54129
Vulnerability Analysis
The vulnerability is an observable response discrepancy in HAXiam's user data endpoint. When a request queries information for an existing user, the application returns an HTTP 200 status code. When the same request targets a non-existent user, the application returns HTTP 404. This binary distinction allows attackers to infer account existence without accessing protected data directly. The flaw requires low-privileged authentication and can be executed over the network with low attack complexity.
The impact escalates when combined with authorization flaws in the same platform. An attacker who has enumerated valid usernames can pivot to abuse missing access control checks and modify or deface other users' microsites.
Root Cause
The root cause is inconsistent response handling in the user lookup logic. The application distinguishes between the "user not found" and "user found" states through HTTP status codes visible to any authenticated caller. A secure implementation should return uniform responses regardless of account existence, preventing side-channel inference.
Attack Vector
An authenticated attacker scripts requests against the user data endpoint using a wordlist of candidate usernames. The attacker parses response codes to build a list of valid accounts. This enumeration then feeds follow-on attacks such as targeted defacement, credential stuffing against enumerated accounts, or exploitation of related authorization weaknesses referenced in the vendor advisory.
Refer to the GitHub Security Advisory GHSA-wh3h-vfcv-m5g5 for additional technical details.
Detection Methods for CVE-2025-54129
Indicators of Compromise
- High-volume authenticated requests to user data endpoints from a single session or source IP
- Sequential or dictionary-ordered username values in request parameters
- Repeated HTTP 404 responses interleaved with HTTP 200 responses from the user lookup endpoint
- Requests originating from automated tools with non-browser User-Agent strings
Detection Strategies
- Deploy web application firewall rules that rate-limit authenticated requests to user-lookup endpoints
- Correlate authentication logs with subsequent enumeration patterns targeting user data URLs
- Alert on session activity that generates a high ratio of 404 to 200 responses in short windows
Monitoring Recommendations
- Enable verbose access logging on all HAXiam endpoints that accept user identifiers as parameters
- Track per-account request rates and flag deviations from baseline behavior
- Retain HTTP status code metrics per session to support retrospective enumeration analysis
How to Mitigate CVE-2025-54129
Immediate Actions Required
- Upgrade HAXiam to version 11.0.5 or later, which resolves the response discrepancy
- Audit access logs for enumeration patterns against user data endpoints prior to patching
- Review authorization checks on site management endpoints to prevent chained exploitation
Patch Information
The maintainers fixed CVE-2025-54129 in HAXiam version 11.0.5. The remediation aligns response behavior so that valid and invalid user lookups produce indistinguishable responses. Details are published in the GitHub Security Advisory GHSA-wh3h-vfcv-m5g5.
Workarounds
- Restrict access to user data endpoints to administrative roles until the patch is applied
- Implement application-layer rate limiting on authenticated user lookup requests
- Introduce a reverse-proxy rule that normalizes 404 responses to 200 for the affected endpoint
# Configuration example
# See the vendor security advisory for authoritative remediation guidance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.