CVE-2025-26485

The Exposure of Sensitive Information to an Unauthorized Actor 
vulnerability impacting Beta80 Life 1st Identity Manager  allows User 
Enumeration using Authentication Rest APIs. Affected: Life 1st version 
1.5.2.14234. Different error messages are returned to failed authentication attempts 
in case of the usage of a wrong password or a non existent user. 


This issue affects Life 1st: 1.5.2.14234.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
ENISACNA
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Common Weakness Enumeration
References
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26485