Dify CVE-2025-11750

No special configuration is required: the vulnerability is present in the default authentication/login and registration flow of Dify-web 1.6.0, which returns distinguishable error messages ('account not found' for non-existent identifiers versus a different incorrect-password message for existing ones). Exploitation requires network reachability to the application's login/registration endpoints (AV:N, PR:N, UI:N) and no authentication. The principal limiting factor is impact scope rather than access: the flaw only discloses account existence, so real-world harm depends on a successful follow-on attack (brute force, credential stuffing, or social engineering), and exposure is reduced where the Dify instance is not internet-facing or sits behind rate-limiting/WAF controls that blunt enumeration.

This is a genuinely low-priority, informational-severity issue rather than a critical threat, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) correctly reflects a remotely reachable, low-complexity, unauthenticated flaw whose only impact is a limited confidentiality leak (C:L) - the existence of valid accounts - with no integrity or availability consequences. The EPSS score of 0.70% (52nd percentile) indicates low probability of exploitation in the next 30 days, which aligns with the nature of the bug: username enumeration is a reconnaissance aid, not a direct compromise vector. Publicly available exploit/POC material exists (via the huntr.com bounty report), but this is NOT the same as active exploitation - the CVE is NOT on CISA KEV, and no SSVC decision data was provided. In practical terms this is a 'high-visibility-but-low-real-risk' finding: it facilitates downstream attacks (brute force, credential stuffing, targeted phishing) rather than causing harm by itself. No signals conflict; the main limitation is that impact is conditional on an attacker then succeeding at a separate secondary attack.

An unauthenticated attacker submits login or registration requests to a Dify-web 1.6.0 instance using a list of candidate emails/usernames and observes that non-existent accounts return an 'account not found' message while existing accounts return a distinct 'incorrect password' message. By diffing these responses the attacker compiles a list of valid accounts to feed into credential-stuffing or spear-phishing campaigns. A POC is publicly documented in the referenced huntr bounty report, and the low attack complexity (AC:L) makes this trivially scriptable.