CVE-2021-34580: Mbconnectline MBCONNECT24

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

Affected products

• Mbconnectline MBCONNECT24: up to and including 2.9.0
• Mbconnectline MYMBCONNECT24: up to and including 2.9.0

Published 2021-10-27. Last modified 2026-06-17.