CVE-2025-65899

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Dec 4, 2025

CISA due date

—

The record

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.

Affected packages

Ecosystem	Package	Introduced	Fixed