The vulnerability allows an unauthenticated attacker to discover valid usernames in FacturaScripts by observing differences in response behavior during login attempts. The application returns distinguishable responses – such as varied time delays, error messages or HTTP status codes – when authenticity of a username is verified. This disclosure of valid account names can be leveraged for subsequent credential‑guessing or social engineering attacks.

FacturaScripts production sites running version 2025.61 (or earlier releases prior to patching) are affected by this issue. The description explicitly cites 2025.61 as vulnerable, but earlier versions may also be impacted until the patch is applied.

The CVSS score is 6.9, indicating moderate severity, while the EPSS score is very low (<1%). The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. However, the attack vector is easily attainable from any internet‑connected host: an unauthenticated attacker can issue login requests and analyze response variations to systematically compile a list of valid usernames, which then facilitates targeted brute‑force or credential‑stuffing attacks.