CVE-2021-37151

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.

• CWE-203

• https://www.cyberark.com/products/
• https://www.gov.il/en/departments/faq/cve_advisories
• https://www.cyberark.com/products/
• https://www.gov.il/en/departments/faq/cve_advisories

Published

Sep 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37146An infinite loop in Open Robotics ros_comm XMLRPC server in …7.5
• CVE-2021-37147Improper input validation vulnerability in header parsing of…7.5
• CVE-2021-37148Improper input validation vulnerability in header parsing of…7.5
• CVE-2021-37149Improper Input Validation vulnerability in header parsing of…7.5
• CVE-2021-3715A flaw was found in the "Routing decision" classifier in the…7.8
• CVE-2021-37150Improper Input Validation vulnerability in header parsing of…7.5
• CVE-2021-37152Multiple XSS issues exist in Sonatype Nexus Repository Manag…5.4
• CVE-2021-37153ForgeRock Access Management (AM) before 7.0.2, when configur…9.8
• CVE-2021-37154In ForgeRock Access Management (AM) before 7.0.2, the SAML2 …9.8
• CVE-2021-37155wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a …9.8
• CVE-2021-37156Redmine 4.2.0 and 4.2.1 allow existing user sessions to cont…7.5
• CVE-2021-37157An issue was discovered in OpenGamePanel OGP-Agent-Linux thr…8.8