Frontier Airlines CVE-2025-62236

No special conditions beyond the affected endpoint being reachable - the flaw is remote and unauthenticated (PR:N/UI:N) against the public Frontier Airlines email-validation endpoint, which returns a distinguishable response for addresses tied to an existing account. The limiting factors are impact-based rather than access-based: exploitation only discloses whether a given email is registered (low confidentiality, no integrity or availability impact), and its value is contingent on the attacker chaining the harvested addresses into a follow-on attack such as phishing or credential stuffing. Because this is a single hosted web service, exploitation is confined to that one site rather than any customer-deployed software.

This is a low-to-moderate real-world risk despite the 6.9 CVSS 4.0 base score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack requiring no user interaction, and the impact is correctly scoped to low confidentiality only (VC:L) with no integrity or availability impact - consistent with CWE-204 (observable response discrepancy / email enumeration). The EPSS score of 0.33% (24th percentile) indicates a low probability of exploitation activity, and there is no CISA KEV listing and no public POC, so this is not under confirmed active exploitation. The signals are internally consistent rather than conflicting: easy to trigger but limited in direct impact. The practical danger is as an enabler - it provides attackers a confirmed list of valid accounts to feed into credential stuffing, phishing, or password-spraying against the same login surface. No SSVC decision data was provided in the input. Bottom line: treat as a reconnaissance/enabler-class information disclosure, not a standalone critical priority.

An unauthenticated attacker scripts automated requests against the public email-validation endpoint, submitting a large list of candidate email addresses and observing which responses indicate an existing account. The attacker builds a verified list of Frontier Airlines customer accounts, then uses it to launch targeted phishing or credential-stuffing attacks. No public exploit code or active exploitation has been identified at time of analysis.