CVE-2025-54834 OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration
Unauthenticated attackers can enumerate valid usernames via the CreateRequest endpoint due to missing rate limiting, exposing user account existence.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54834?
CVE-2025-54834 is a medium-severity vulnerability in OPEXUS FOIAXpress Public Access Link (PAL), published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.
Weakness: CWE-204
Which versions are affected by CVE-2025-54834?
It affects 1 product.
Products include Opexustech Foiaxpress Public Access Link.
How do I fix CVE-2025-54834?
No fix has been published for CVE-2025-54834 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-54834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54834 exists.
Other vulnerabilities in OPEXUS FOIAXpress Public Access Link (PAL)
Sources
Also known as GHSA-989f-fh5x-8jw4.