Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames.
CVSS 4.0MEDIUM 6.9·Network·No auth·No interaction·EPSS 0.00372·Published 2025-07-04·Fixed in 8.4.1CWE-203