CVE-2025-0693: AWS Sign-in IAM Login Flow · Observable Response Discrepancy
Affects AWS Sign-in IAM Login FlowSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Jan 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
European organizations should implement several specific measures to mitigate this vulnerability: 1) Monitor AWS CloudTrail and AWS IAM login logs for unusual login attempts or patterns indicative of brute force enumeration. 2) Enforce strict rate limiting and throttling on login attempts to reduce the feasibility of timing attacks. 3) Employ multi-factor authentication (MFA) universally to reduce the risk of account compromise even if usernames are enumerated. 4) Use AWS IAM Access Analyzer and AWS Config rules to audit and restrict permissions, minimizing the impact of any compromised accounts. 5) Encourage AWS to provide patches or updates addressing timing discrepancies and apply them promptly once available. 6) Implement uniform response times and generic error messages in custom authentication flows if applicable. 7) Conduct regular security awareness training to help users recognize phishing attempts that may follow username enumeration. 8) Consider deploying Web Application Firewalls (WAF) or Intrusion Detection Systems (IDS) with anomaly detection tuned to identify enumeration attempts. These steps go beyond generic advice by focusing on detection, prevention, and rapid response tailored to this specific timing-based enumeration threat.
Description
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.