CVE-2025-12455 Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica.
Attackers can enumerate valid usernames via response discrepancies in the Vertica management console, facilitating password brute-force attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-12455?
CVE-2025-12455 is a medium-severity vulnerability in OpenText™ Vertica, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing. The vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.
Weakness: CWE-204
Which versions are affected by CVE-2025-12455?
It affects 1 product.
Products include Opentext Vertica.
How do I fix CVE-2025-12455?
No fix has been published for CVE-2025-12455 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12455 being exploited?
There is no known exploitation of CVE-2025-12455 in the wild and no public exploit code.
Other vulnerabilities in OpenText™ Vertica
- CVE-2017-5802 Privilege escalation in Vertica Analytics Platform
- CVE-2016-2002 Command injection in n/a
- CVE-2015-6867 Auth bypass in n/a
- CVE-2025-12453 Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.
- CVE-2025-12454 Improper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.
Sources
Also known as GHSA-phcr-v9ch-26r8.