Security readout for executives and security teams
Plain-English summary
userSpice 4.3.24, an open-source user management framework, exposes an endpoint that tells attackers whether a username exists on the site. That lets unauthenticated attackers build a list of valid accounts, which fuels password guessing, targeted phishing, and account takeover attempts against your users.
Executive priority
Priority is moderate. Treat as an account-security hygiene issue: schedule patch or endpoint hardening within the standard maintenance window, and pair with MFA enforcement. Elevate to high priority only if a customer-facing userSpice site handles sensitive accounts or has weak password policies today.
Technical view
The existingUsernameCheck.php endpoint in userSpice 4.3.24 responds differently depending on whether a submitted username exists, returning a "taken" string for known accounts. An unauthenticated attacker can POST candidate usernames and parse responses to enumerate valid accounts. This maps to CWE-204 (observable response discrepancy). CVSS 3.1 base is 9.8, though real-world impact is confidentiality of usernames, not direct system compromise.
Likely exposure
Any internet-facing site running userSpice 4.3.24 with the existingUsernameCheck.php endpoint reachable without authentication. Deployments behind SSO, WAF rate limiting, or private networks have reduced exposure. userSpice is a niche PHP user management framework, so most enterprises are unaffected unless a subsidiary or legacy site uses it.
Exploitation context
Public proof-of-concept exists at ExploitDB entry 44872 and a VulnCheck advisory documents the flaw, so weaponization is trivial and requires no authentication. CISA KEV does not list this CVE and no confirmed active exploitation was cited. Realistic threat is bulk username harvesting feeding credential stuffing or phishing rather than direct system compromise.
Researcher notes
CVSS 9.8 overstates real-world impact: CWE-204 yields username disclosure, not code execution or data write. Weigh the disclosed score against actual confidentiality-only impact when triaging. Validate the endpoint's presence and behavior directly; some deployments may have customized or removed existingUsernameCheck.php. Correlate with login endpoint behavior for a second enumeration oracle. No KEV listing observed as of 2026-07-11.
Mitigation direction
- Check the UserSpice vendor site and release notes for a patched build newer than 4.3.24 and upgrade.
- Restrict or remove public access to existingUsernameCheck.php via web server rules or WAF until patched.
- Normalize response bodies so existing and non-existing usernames return identical output and status codes.
- Add strict rate limiting and CAPTCHA on username lookup and login endpoints.
- Enable MFA on all userSpice accounts to blunt follow-on credential attacks.
Validation and detection
- Inventory sites using userSpice and confirm version; flag any instance at 4.3.24 or unspecified.
- In a controlled test, send known-good and random usernames to existingUsernameCheck.php and compare responses for the 'taken' indicator.
- Review web server and WAF logs for high-volume POSTs to existingUsernameCheck.php from single sources.
- Verify authentication and rate-limiting controls on the endpoint after remediation.
- Confirm patched or hardened deployments return uniform responses for valid and invalid usernames.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-204: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-25350 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-44872CVE reference, VulnCheck · exploit
- VulnCheck Advisory: userSpice 4.3.24 Username Enumeration via existingUsernameCheck.phpCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Response Discrepancy
Observable Response Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.