CVE-2025-11750
Langgenius Dify 1.6.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-11750 is a medium-severity Missing Standardized Error Handling Mechanism (CWE-544) vulnerability in Langgenius Dify. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to SI-11 (Error Handling) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35362
Vulnerability Data
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system…
more
responds with a message such as "account not found." Conversely, when the username or email exists but the password is incorrect, a different error message is returned. This discrepancy allows an attacker to enumerate valid user accounts by analyzing the error responses, potentially facilitating targeted social engineering, brute force, or credential stuffing attacks.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: dify
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-11 requires a consistent, non-revealing approach to generating error messages across the system.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly include defining and enforcing standardized error-handling patterns across code.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding explicitly calls for uniform, standardized error handling to avoid introducing weaknesses.
Security testing can detect inconsistent error handling but does not itself define the standardized mechanism.
Secure development life cycle requires consistent, standardized error-handling practices across the codebase.
Application security requirements can mandate standardized error handling as a non-functional requirement.
Secure system architecture and engineering principles include consistent exception and error-handling mechanisms.