CVE-2024-47057

SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack. MitigationPlease update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

• CWE-203

• https://github.com/mautic/mautic/security/advisories/GHSA-424x-cxvh-wq9p

Published

May 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4705The Testimonials Widget plugin for WordPress is vulnerable t…5.4
• CVE-2024-47050Prior to this patch being applied, Mautic's tracking was vul…6.1
• CVE-2024-47051This advisory addresses two critical security vulnerabilitie…9.9
• CVE-2024-47053This advisory addresses an authorization vulnerability in Ma…7.7
• CVE-2024-47055SummaryThis advisory addresses a security vulnerability in M…4.3
• CVE-2024-47056SummaryThis advisory addresses a security vulnerability in M…5.1
• CVE-2024-47058With access to edit a Mautic form, the attacker can add Cros…4.8
• CVE-2024-47059When logging in with the correct username and incorrect weak…4.3
• CVE-2024-4706The WordPress + Microsoft Office 365 / Azure AD | LOGIN plug…6.4
• CVE-2024-47060Zitadel is an open source identity management platform. In Z…6.5
• CVE-2024-47061Plate is a javascript toolkit that makes it easier for you t…8.3
• CVE-2024-47062Navidrome is an open source web-based music collection serve…8.8