CVE-2025-0693

Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration PUBLISHED

Description (CNA)

Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.

Affected (CNA)

Vendor / product	Versions
AWS / AWS Sign-in IAM Login Flow	affected N/A

CWE

CWE-204, CWE-208

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-002/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.