CVE-2025-2910 User enumeration vulnerability in MeetMe products
An attacker can determine if an email address is registered via specific error messages in the password reset module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2910?
CVE-2025-2910 is a medium-severity vulnerability in Fermax MeetMe, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.
Weakness: CWE-204
Which versions are affected by CVE-2025-2910?
How do I fix CVE-2025-2910?
No fix has been published for CVE-2025-2910 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2910 being exploited?
There is no known exploitation of CVE-2025-2910 in the wild and no public exploit code.
Sources
Also known as GHSA-jc64-qjc6-h5vp.