CVE-2025-67806: Sage DPW Information Disclosure Flaw

CVE-2025-67806 Overview

The login mechanism in Sage DPW version 2021_06_004 and earlier contains a username enumeration vulnerability. The application displays distinct responses for valid and invalid usernames, enabling attackers to systematically enumerate existing user accounts. This information disclosure weakness allows reconnaissance efforts that could facilitate subsequent targeted attacks against verified accounts.

Critical Impact

Attackers can identify valid usernames through differential login responses, enabling targeted credential attacks and social engineering campaigns against confirmed user accounts.

Affected Products

• Sage DPW versions before 2021_06_000
• Sage DPW version 2021_06_004

Discovery Timeline

• 2026-04-01 - CVE CVE-2025-67806 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-67806

Vulnerability Analysis

This vulnerability represents a classic username enumeration weakness that occurs when an application provides distinguishable feedback between authentication attempts using valid versus invalid usernames. When a user attempts to log in with a non-existent username, the application returns a different error message or response timing compared to attempts using a valid username with an incorrect password.

The root cause lies in the authentication flow's early validation logic, which checks username existence before password validation. This creates an observable difference in application behavior that attackers can leverage to build a list of valid user accounts without requiring any credentials.

Root Cause

The vulnerability stems from improper implementation of the authentication error handling mechanism. The login functionality validates the username against the user database first and returns a distinct error when the username is not found. This differs from the error returned when a valid username is provided with an incorrect password. According to security best practices, authentication failures should return generic, identical responses regardless of whether the username exists, preventing attackers from distinguishing between invalid usernames and incorrect passwords.

Attack Vector

This is a network-based attack that requires high complexity to exploit effectively. An attacker would typically automate requests to the login endpoint, cycling through potential usernames while monitoring response patterns. The attack methodology involves:

1. Sending authentication requests with candidate usernames and arbitrary passwords
2. Analyzing the response content, timing, or HTTP status codes for differences
3. Cataloging usernames that produce responses indicating account existence
4. Using the enumerated list for targeted password spraying, credential stuffing, or social engineering attacks

On-premise administrators running newer versions of Sage DPW can toggle this behavior to mitigate the risk, though older installations remain vulnerable by default. Additional technical details are available in the Pastebin Security Post.

Detection Methods for CVE-2025-67806

Indicators of Compromise

• High volume of authentication failures from a single source IP targeting multiple usernames
• Sequential or alphabetical patterns in attempted usernames indicating automated enumeration
• Rapid succession of login attempts with minimal delay between requests
• Authentication logs showing systematic testing of username patterns (e.g., first.last, firstinitial.last)

Detection Strategies

• Implement rate limiting detection rules to identify sources exceeding normal authentication attempt thresholds
• Monitor for authentication attempts using common username wordlists or organizational naming conventions
• Correlate failed login events across time windows to identify enumeration patterns
• Deploy web application firewalls (WAF) with rules to detect username enumeration behavior

Monitoring Recommendations

• Enable detailed authentication logging to capture full request/response metadata
• Configure SIEM alerts for anomalous login failure patterns from single source addresses
• Establish baseline metrics for normal authentication failure rates to detect deviations
• Monitor for subsequent password spraying attempts against usernames confirmed through enumeration

How to Mitigate CVE-2025-67806

Immediate Actions Required

• Upgrade Sage DPW to version 2021_06_000 or later
• For on-premise deployments on newer versions, enable the configuration toggle to prevent differential responses
• Implement account lockout policies to limit the effectiveness of enumeration attempts
• Deploy CAPTCHA or similar challenge-response mechanisms after multiple failed login attempts

Patch Information

Sage has addressed this vulnerability in versions 2021_06_000 and later by providing administrators with the ability to toggle uniform authentication responses. Organizations should consult the SageDPW Resource Page for official upgrade guidance and patch availability.

Workarounds

• Place the login endpoint behind a reverse proxy that normalizes response timing and content
• Implement rate limiting at the network level to slow enumeration attempts
• Add artificial delays to authentication responses to make timing-based enumeration impractical
• Consider implementing multi-factor authentication to reduce the impact of username enumeration

For environments where immediate patching is not feasible, network-level controls and monitoring remain critical compensating controls until the upgrade can be completed.