CVE-2025-39665: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39665 is a user enumeration vulnerability in NagVis's Checkmk MultisiteAuth module that allows unauthenticated remote attackers to enumerate valid Checkmk usernames. It affects all NagVis versions before 1.9.48 and was published on December 3, 2025, with a patch merged on December 2, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Red Hat CVE, GitHub PR #411).

The root cause is an observable discrepancy (CWE-203) in the CoreLogonMultisite PHP class within share/server/core/classes/CoreLogonMultisite.php. Prior to the fix, when a user did not exist in the authentication file, the application returned a distinct error message ("User not found in auth file.") compared to the error returned for an invalid session, allowing an attacker to differentiate between valid and invalid usernames. The fix unifies error responses and replaces the local cookie validation logic — which involved looking up usernames in the htpasswd/serials file — with a streamlined approach that delegates session validation to the Checkmk REST API, eliminating the username-existence side channel. No authentication or special privileges are required to exploit this vulnerability over the network (GitHub PR #411).

Successful exploitation allows an unauthenticated attacker to systematically discover valid Checkmk usernames configured in NagVis, impacting confidentiality with no effect on integrity or availability. Enumerated usernames can be leveraged for targeted credential stuffing, brute-force attacks, or social engineering campaigns against monitoring infrastructure. Since NagVis is typically deployed in network operations and IT monitoring environments, exposure of valid usernames could facilitate further attacks against sensitive infrastructure management systems (Red Hat CVE, GitHub PR #411).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.069% (0.000690), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and is executable remotely over the network, making it trivially exploitable if a PoC were to emerge (Red Hat CVE, Tenable Nessus).

1. Reconnaissance: Identify internet-facing or network-accessible NagVis instances running versions prior to 1.9.48, using tools like Shodan, Censys, or network scanning.
2. Identify the authentication endpoint: Locate the NagVis login page that uses the Checkmk MultisiteAuth (CoreLogonMultisite) module.
3. Craft authentication requests: Submit login or cookie validation requests with candidate usernames and arbitrary/invalid session data (e.g., a crafted cookie value in the format <username>:<session_id>:<hash>).
4. Observe differential responses: Compare error messages returned by the server — a "User not found in auth file" response indicates the username does not exist, while a different error (e.g., invalid session/cookie) indicates the username is valid.
5. Enumerate usernames: Iterate over a wordlist of candidate usernames, recording which ones produce the "valid user" response to build a list of confirmed Checkmk accounts for use in follow-on attacks (GitHub PR #411).

• Network: High volume of HTTP requests to the NagVis authentication endpoint from a single IP or small IP range, particularly with varying usernames but invalid/random session IDs or cookie hashes.
• Logs: NagVis or web server access logs showing repeated authentication attempts with different usernames and consistent patterns of "User not found" vs. other authentication error responses; unusual spikes in failed login attempts.
• Application Logs: Repeated AuthenticationException entries in NagVis logs with messages such as "User not found in auth file" or "Cookie is invalid" from the same source IP.
• Behavioral: Automated, sequential username enumeration patterns (e.g., dictionary-based usernames submitted in rapid succession) visible in access logs.

Upgrade NagVis to version 1.9.48 or later, which contains the fix that unifies error responses to prevent username enumeration (NagVis Changelog, GitHub PR #411). As interim mitigations, restrict network access to the NagVis interface using firewall rules or VPN, implement rate limiting and account lockout policies on the authentication endpoint, and monitor logs for enumeration patterns. Using strong, unique passwords for all Checkmk accounts reduces the risk of follow-on credential attacks even if usernames are discovered.

The vulnerability was assigned by Checkmk and disclosed via the NagVis GitHub repository and changelog. Red Hat has tracked the CVE in their security advisory database. No significant public researcher commentary, media coverage, or notable social media discussion beyond automated CVE tracking feeds has been observed for this vulnerability (Red Hat CVE, GitHub PR #411).