CVE-2025-65899

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.

• CWE-204

• https://github.com/DifuseHQ/KalmiaProduct
• https://github.com/Noxurge/CVE-2025-65899/blob/main/README.mdExploit, Third Party Advisory

Published

Dec 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6589Vulnerability in Wikimedia Foundation MediaWiki. This vulner…2.1
• CVE-2025-65890A device-ID validation flaw in OneFlow v0.9.0 allows attacke…7.5
• CVE-2025-65891A GPU device-ID validation flaw in OneFlow v0.9.0 allows att…7.5
• CVE-2025-65892Reflected Cross-Site Scripting (rXSS) in krpano before versi…6.1
• CVE-2025-65896SQL injection vulnerability in long2ice assyncmy thru 0.2.10…9.8
• CVE-2025-65897zdh_web is a data collection, processing, monitoring, schedu…8.8
• CVE-2025-6590Exposure of Sensitive Information to an Unauthorized Actor v…4.6
• CVE-2025-65900Kalmia CMS version 0.2.0 contains an Incorrect Access Contro…6.5
• CVE-2025-6591Vulnerability in Wikimedia Foundation MediaWiki. This vulner…0
• CVE-2025-6592Vulnerability in Wikimedia Foundation AbuseFilter. This vuln…2.1
• CVE-2025-65922PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors h…4.3
• CVE-2025-65923A Stored Cross-Site Scripting (XSS) vulnerability was discov…5.4