CVE-2025-0693

Description

Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.

Affected Platforms

Weakness Type

CWE-204, CWE-208

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-002/