A low‑privileged user lacking the admin or power role can submit a crafted payload to the realname, tz, or email parameters of the /splunkd/__raw/services/authentication/users/username REST API endpoint when changing a password. The payload may significantly delay page load times or temporarily make Splunk Web unresponsive, representing a client‑side denial‑of‑service effect. This weakness is a classic instance of CWE‑400: Input Validation Failure.

Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121 are affected.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low exploitation probability at this time. The vulnerability has not been catalogued in the CISA KEV list. The attack vector is inferred to be a crafted HTTP request to the REST endpoint, performed by an unprivileged user who can submit the malicious parameters during a password change. Successful exploitation would yield a local client‑side denial‑of‑service but no compromise of confidentiality or integrity.