CVE-2025-62181

Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. This only applies to deprecated basic-authentication feature and other more secure authentication mechanisms are recommended. A fix is being provided in the 24.1.4, 24.2.4, and 25.1.1 patch releases. Please note: Basic credentials authentication service type is deprecated started in 24.2 version: https://docs.pega.com/bundle/platform/page/platform/release-notes/security/whats-new-security-242.html.

• CWE-204

• https://support.pega.com/support-doc/pega-security-advisory-j25-vulnerability-remediation-note

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62176Mastodon is a free, open-source social network server based …4.3
• CVE-2025-62177WeGIA is an open source Web Manager for Institutions with a …8.8
• CVE-2025-62178WeGIA is an open source Web Manager for Institutions with a …5.4
• CVE-2025-62179WeGIA is an open source Web Manager for Institutions with a …8.8
• CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution Vuln…7.8
• CVE-2025-62180Pega Platform versions 8.3.0 through Infinity 25.1.2 are aff…7.1
• CVE-2025-62182Pega Customer Service Framework versions 8.7.0 through 25.1.…5.3
• CVE-2025-62183Pega Platform versions 8.1.0 through 25.1.1 are affected by …4.8
• CVE-2025-62184Pega Platform versions 8.1.0 through 25.1.0 are affected by …3.4
• CVE-2025-62185In Ankitects Anki before 25.02.5, a crafted shared deck can …7.8
• CVE-2025-62186Ankitects Anki before 25.02.5 allows a crafted shared deck o…7.8
• CVE-2025-62187In Ankitects Anki before 25.02.6, crafted sound file referen…3.3