CVE-2025-67806: Sage DPW Information Disclosure Flaw

CVE-2025-67806 Overview

The login mechanism in Sage DPW version 2021_06_004 and earlier contains a username enumeration vulnerability. The application displays distinct responses for valid and invalid usernames, enabling attackers to systematically enumerate existing user accounts. This information disclosure weakness allows reconnaissance efforts that could facilitate subsequent targeted attacks against verified accounts.

Critical Impact
Attackers can identify valid usernames through differential login responses, enabling targeted credential attacks and social engineering campaigns against confirmed user accounts.

Affected Products

Sage DPW versions before 2021_06_000
Sage DPW version 2021_06_004

Discovery Timeline

2026-04-01 - CVE CVE-2025-67806 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-67806

Vulnerability Analysis

This vulnerability represents a classic username enumeration weakness that occurs when an application provides distinguishable feedback between authentication attempts using valid versus invalid usernames. When a user attempts to log in with a non-existent username, the application returns a different error message or response timing compared to attempts using a valid username with an incorrect password.

The root cause lies in the authentication flow's early validation logic, which checks username existence before password validation. This creates an observable difference in application behavior that attackers can leverage to build a list of valid user accounts without requiring any credentials.

Root Cause

The vulnerability stems from improper implementation of the authentication error handling mechanism. The login functionality validates the username against the user database first and returns a distinct error when the username is not found. This differs from the error returned when a valid username is provided with an incorrect password. According to security best practices, authentication failures should return generic, identical responses regardless of whether the username exists, preventing attackers from distinguishing between invalid usernames and incorrect passwords.

Attack Vector

This is a network-based attack that requires high complexity to exploit effectively. An attacker would typically automate requests to the login endpoint, cycling through potential usernames while monitoring response patterns. The attack methodology involves:

Sending authentication requests with candidate usernames and arbitrary passwords
Analyzing the response content, timing, or HTTP status codes for differences
Cataloging usernames that produce responses indicating account existence
Using the enumerated list for targeted password spraying, credential stuffing, or social engineering attacks

On-premise administrators running newer versions of Sage DPW can toggle this behavior to mitigate the risk, though older installations remain vulnerable by default. Additional technical details are available in the Pastebin Security Post.

Detection Methods for CVE-2025-67806

Indicators of Compromise

High volume of authentication failures from a single source IP targeting multiple usernames
Sequential or alphabetical patterns in attempted usernames indicating automated enumeration
Rapid succession of login attempts with minimal delay between requests
Authentication logs showing systematic testing of username patterns (e.g., first.last, firstinitial.last)

Detection Strategies

Implement rate limiting detection rules to identify sources exceeding normal authentication attempt thresholds
Monitor for authentication attempts using common username wordlists or organizational naming conventions
Correlate failed login events across time windows to identify enumeration patterns
Deploy web application firewalls (WAF) with rules to detect username enumeration behavior

Monitoring Recommendations

Enable detailed authentication logging to capture full request/response metadata
Configure SIEM alerts for anomalous login failure patterns from single source addresses
Establish baseline metrics for normal authentication failure rates to detect deviations
Monitor for subsequent password spraying attempts against usernames confirmed through enumeration

How to Mitigate CVE-2025-67806

Immediate Actions Required

Upgrade Sage DPW to version 2021_06_000 or later
For on-premise deployments on newer versions, enable the configuration toggle to prevent differential responses
Implement account lockout policies to limit the effectiveness of enumeration attempts
Deploy CAPTCHA or similar challenge-response mechanisms after multiple failed login attempts

Patch Information

Sage has addressed this vulnerability in versions 2021_06_000 and later by providing administrators with the ability to toggle uniform authentication responses. Organizations should consult the SageDPW Resource Page for official upgrade guidance and patch availability.

Workarounds

Place the login endpoint behind a reverse proxy that normalizes response timing and content
Implement rate limiting at the network level to slow enumeration attempts
Add artificial delays to authentication responses to make timing-based enumeration impractical
Consider implementing multi-factor authentication to reduce the impact of username enumeration

For environments where immediate patching is not feasible, network-level controls and monitoring remain critical compensating controls until the upgrade can be completed.