Identity and Secrets Manager
CVE-2021-37151: CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the…
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Identity 21.5 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate between a valid user and an invalid one (aka Username Enumeration). Response differentiation enables attackers to enumerate usernames of valid application users. Attackers can use this information to leverage brute-force and dictionary attacks in order to discover valid account information such as passwords.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.