{"cve":"CVE-2020-25200","nvd":{"published":"2020-10-01T18:15:12.577","modified":"2026-06-17T03:06:34.277","status":"Modified","description":"Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-203"],"references":["https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200","https://pritunl.com","https://pritunl.com/security","https://github.com/lukaszstu/pritunl/blob/master/CVE-2020-25200","https://pritunl.com"],"products":["pritunl:pritunl"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-25200","score":0.0747,"percentile":0.94469,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}