CVE-2025-0693: Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0693?
CVE-2025-0693 is considered a medium severity vulnerability due to its potential for brute force enumeration of valid IAM usernames.
How do I fix CVE-2025-0693?
To mitigate CVE-2025-0693, implement rate limiting and monitor login attempts to prevent username enumeration through response time analysis.
What are the potential impacts of CVE-2025-0693?
The exploitation of CVE-2025-0693 can lead to unauthorized access attempts by revealing valid IAM usernames.
Who is affected by CVE-2025-0693?
Organizations using Amazon AWS with IAM user login flows are affected by CVE-2025-0693.
What is the nature of CVE-2025-0693?
CVE-2025-0693 specifically targets variable response times during the AWS Sign-in IAM user login flow.