CVE-2025-56132: Authentication Bypass by Primary Weakness
Source CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 7.3 High · fixed in 4.2 : patch versions soon.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- versions prior to 4.2
- Patch
- Available – fixed in 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 30 Sep 2025
Detectable: evidence found.
nuclei template: LiquidFiles < 4.2 - User Enumeration via Password Reset
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-56132, organizations should first upgrade to LiquidFiles version 4.2 or later to benefit from user-based lockout mechanisms that limit brute-force attempts on individual accounts. Administrators should configure the application to standardize password reset responses, ensuring that the server returns identical messages regardless of whether an email address exists, thereby preventing attackers from distinguishing valid users. Implementing multi-factor authentication (MFA) for user accounts will reduce the risk of unauthorized access even if valid usernames are discovered. Network-level protections such as Web Application Firewalls (WAFs) can be configured to detect and block suspicious patterns indicative of enumeration attempts, including distributed requests from multiple IPs. Rate limiting should be enhanced beyond IP-based controls to include behavioral analytics and anomaly detection. Regular monitoring and alerting on password reset requests and failed login attempts can help identify exploitation attempts early. Finally, user awareness training should emphasize phishing and social engineering risks stemming from leaked user information.
Description
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.