cve-2025-56132
HIGH vulncheck_kevLiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.
- Published
- 2026-04-30 00:00 UTC
- Last Modified
- 2026-04-30
CVSS details not available.
No product information available.
No references available.
No linked vulnerabilities found.
{
"cvss": 0.0,
"datePublished": "2026-04-30T00:00:00Z",
"dateUpdated": "2026-04-30T00:00:00Z",
"description": "LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.",
"dueDate": "",
"id": "CVE-2025-56132",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "liquidfiles",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "HIGH",
"source": "vulncheck_kev",
"title": "liquidfiles liquidfiles Authentication Bypass by Primary Weakness",
"vendor": "liquidfiles"
}