CWE-208

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "ezsystems/ezplatform-kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.3.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-02T20:53:43Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter \u0027ibexa.security.authentication.constant_auth_time\u0027. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.",
  "id": "GHSA-342c-vcff-2ff2",
  "modified": "2022-06-02T20:53:43Z",
  "published": "2022-06-02T20:53:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-342c-vcff-2ff2"
    },
    {
      "type": "WEB",
      "url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ezsystems/ezplatform-kernel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Login timing attack in ezsystems/ezplatform-kernel"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260713141742-763625a20721"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "last_affected": "1.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:51Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nWhen running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data.\n\n### Patches\n\nThis has been patched in OpenBao v2.6.0.",
  "id": "GHSA-34fc-gh42-pj53",
  "modified": "2026-09-22T20:36:51Z",
  "published": "2026-09-22T20:36:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3388"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3472"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenBao\u0027s Recovery Mode Vulnerable To Token Leakage via Timing Attack"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fastify-bearer-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.1"
            },
            {
              "last_affected": "6.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fastify/bearer-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fastify/bearer-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-15T19:14:27Z",
    "nvd_published_at": "2022-07-14T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nfastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack.\n\nAll versions of fastify-bearer-auth are also affected.\n\n### Patches\n\nWe released:\n\n* v8.0.1 with a fix for the Fastify v4 line\n* v7.0.2 with a fix for the Fastify v3 line\n\n### Workarounds\n\nThere are no workarounds. Update your dependencies.\n\n### References\n\nhttps://hackerone.com/reports/1633287\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/fastify/fastify-bearer-auth](https://github.com/fastify/fastify-bearer-auth)\n* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)\n",
  "id": "GHSA-376v-xgjx-7mfr",
  "modified": "2022-07-21T15:57:26Z",
  "published": "2022-07-15T19:14:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31142"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1633287"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastify/fastify-bearer-auth"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fastify-bearer-auth vulnerable to Timing Attack Vector"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-21T22:16:48Z",
    "severity": "MODERATE"
  },
  "details": "Catalyst::Plugin::Authentication versions through 0.10024 for Perl  is susceptible to timing attacks.\n\nThese versions use Perl\u0027s built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.",
  "id": "GHSA-37jv-v9vv-wxwv",
  "modified": "2026-07-23T18:30:34Z",
  "published": "2026-05-22T00:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5091"
    },
    {
      "type": "WEB",
      "url": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b0515f492257438cf07082acf1e10d06e8088a5e.patch"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_025/changes"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/21/19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.15"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:25:05Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\n`Grav\\Common\\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP\u0027s `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.\n\nThe codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.\n\n## Affected product and version\n\nProduct: Grav CMS, getgrav/grav\nConfirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3\n\n## Affected code\n\n`system/src/Grav/Common/Utils.php`, lines 1512 to 1521:\n```php\npublic static function verifyNonce($nonce, $action)\n{\n    //Safety check for multiple nonces\n    if (is_array($nonce)) {\n        $nonce = array_shift($nonce);\n    }\n\n    //Nonce generated 0-12 hours ago\n    if ($nonce === self::getNonce($action)) {\n        return true;\n    }\n\n    //Nonce generated 12-24 hours ago\n    return $nonce === self::getNonce($action, true);\n}\n```\n\nThe nonce itself is `md5($tick . \u0027|\u0027 . $action . \u0027|\u0027 . $username . \u0027|\u0027 . session_id() . \u0027|\u0027 . Security::getNonceKey())`, computed in the private `generateNonceString()` a few lines above. `Security::getNonceKey()` is an installation level secret. So the value being compared with `===` is a value derived from a secret, which is exactly the case `hash_equals()` exists for.\n\n## Proof of concept, verified, real output\n\nI could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP\u0027s `===` string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav\u0027s nonces have, 32 hex characters, an md5 digest.\n\nStep 1, confirm PHP build:\n```\n$ php -v\nPHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)\n```\n\nStep 2, benchmark script, measures the median time of `$a === $b` over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:\n```php\n\u003c?php\n// timing_poc2.php\nfunction timeCompare(string $a, string $b, int $iterations): float {\n    $r = null;\n    $start = hrtime(true);\n    for ($i = 0; $i \u003c $iterations; $i++) {\n        $r = ($a === $b);\n    }\n    $end = hrtime(true);\n    return ($end - $start) / $iterations;\n}\n\nfunction median(array $arr): float {\n    sort($arr);\n    $n = count($arr);\n    $mid = intdiv($n, 2);\n    return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;\n}\n\nfunction runExperiment(int $len, int $iterations, int $trials): array {\n    $secret = bin2hex(random_bytes((int)ceil($len / 2)));\n    $secret = substr($secret, 0, $len);\n\n    $wrongEarly = $secret;\n    $wrongEarly[0] = ($secret[0] === \u0027a\u0027) ? \u0027b\u0027 : \u0027a\u0027;\n\n    $wrongLate = $secret;\n    $last = $len - 1;\n    $wrongLate[$last] = ($secret[$last] === \u0027a\u0027) ? \u0027b\u0027 : \u0027a\u0027;\n\n    $earlyTimes = [];\n    $lateTimes = [];\n    timeCompare($wrongEarly, $secret, 20000);\n    timeCompare($wrongLate, $secret, 20000);\n    for ($t = 0; $t \u003c $trials; $t++) {\n        $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);\n        $lateTimes[]  = timeCompare($wrongLate, $secret, $iterations);\n    }\n    return [median($earlyTimes), median($lateTimes)];\n}\n\necho \"=== Length 4096 bytes, establishes the primitive is not constant time ===\\n\";\n[$e, $l] = runExperiment(4096, 20000, 15);\nprintf(\"Median mismatch at position 0    : %.2f ns/op\\n\", $e);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l);\nprintf(\"Ratio (late/early)               : %.2fx\\n\\n\", $l / $e);\n\necho \"=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\\n\";\n[$e2, $l2] = runExperiment(32, 200000, 21);\nprintf(\"Median mismatch at position 0    : %.2f ns/op\\n\", $e2);\nprintf(\"Median mismatch at last position : %.2f ns/op\\n\", $l2);\nprintf(\"Ratio (late/early)               : %.2fx\\n\", $l2 / $e2);\n```\n\nStep 3, run it three times to confirm the result is reproducible and not noise:\n```\n$ php timing_poc2.php\n```\n\nActual output, run 1:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 13.83 ns/op\nMedian mismatch at last position : 338.58 ns/op\nRatio (late/early)               : 24.48x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 14.13 ns/op\nMedian mismatch at last position : 17.41 ns/op\nRatio (late/early)               : 1.23x\n```\n\nActual output, run 2:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 14.25 ns/op\nMedian mismatch at last position : 333.99 ns/op\nRatio (late/early)               : 23.44x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 13.83 ns/op\nMedian mismatch at last position : 17.24 ns/op\nRatio (late/early)               : 1.25x\n```\n\nActual output, run 3:\n```\n=== Length 4096 bytes, establishes the primitive is not constant time ===\nMedian mismatch at position 0    : 14.20 ns/op\nMedian mismatch at last position : 336.89 ns/op\nRatio (late/early)               : 23.73x\n\n=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\nMedian mismatch at position 0    : 13.98 ns/op\nMedian mismatch at last position : 17.39 ns/op\nRatio (late/early)               : 1.24x\n```\n\nInterpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof `===` is not constant time in this PHP build. At the real nonce length of 32 bytes the same direction of effect is present and reproducible across all three runs, roughly a 1.24x ratio, about 3 to 4 nanoseconds difference per comparison, but the signal is much smaller in absolute terms. I want to be direct about what this does and does not show. It proves the comparison used by `verifyNonce()` is not constant time and therefore not the right primitive for comparing secrets, which is why `hash_equals()` exists and is already used elsewhere in this codebase for the same category of check. It does not by itself prove a practical remote timing attack against a live Grav install, since a real attack would need to extract a nanosecond scale signal through normal HTTP round trip jitter, which is a much harder, though not unprecedented, condition and would need many repeated requests with statistical averaging per byte guessed. I did not attempt that network level attack since I do not have a live target instance.\n\n## Impact\n\n`verifyNonce()` is Grav\u0027s documented core primitive for CSRF protection, used directly by core and referenced by the plugin ecosystem, including the Form plugin and Admin plugin, both outside this repository. Because the comparison is not constant time, an attacker in a position to send many requests and measure response timing with enough precision could in principle recover a valid nonce byte by byte rather than needing to guess the full 32 character value at once, weakening the CSRF protection below its intended security margin. The practical difficulty of pulling this off over a real network, given millisecond scale jitter against a nanosecond scale signal, is high, which is why I am reporting this as a hardening issue rather than claiming a demonstrated working exploit against a live site.\n\n## Suggested fix\n\nReplace the two `===` comparisons in `verifyNonce()` with `hash_equals()`, matching the pattern already used in `Session.php`, `FileCache.php`, `Scheduler.php`, and `JobQueue.php`:\n```php\npublic static function verifyNonce($nonce, $action)\n{\n    if (is_array($nonce)) {\n        $nonce = array_shift($nonce);\n    }\n\n    if (!is_string($nonce)) {\n        return false;\n    }\n\n    if (hash_equals(self::getNonce($action), $nonce)) {\n        return true;\n    }\n\n    return hash_equals(self::getNonce($action, true), $nonce);\n}\n```\n`hash_equals()` also correctly requires the first argument to be a string, so the existing implicit array-to-string edge cases are worth double checking when you make this change.\n\n===========================================================\nCWE FIELD\n===========================================================\nCWE-208, Observable Timing Discrepancy\n\n===========================================================\nCVSS CALCULATOR SELECTIONS (v3.1)\n===========================================================\nAttack Vector: Network\nAttack Complexity: High\nPrivileges Required: None\nUser Interaction: None\nScope: Unchanged\nConfidentiality: None\nIntegrity: Low\nAvailability: None\n\nResulting vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\nResulting score: 5.3, severity Medium\n\nNote for the maintainer: Attack Complexity is set to High because, as shown above, the measured timing signal at the real nonce length is small, on the order of a few nanoseconds, so reliable remote exploitation would require substantial statistical averaging and a favorable network position. If your own testing shows this is easier to exploit against a real deployment than my local measurement suggests, please rescore Attack Complexity to Low.\n\n===========================================================\nSEVERITY FIELD\n===========================================================\nModerate",
  "id": "GHSA-38p6-h87p-r4cg",
  "modified": "2026-09-17T20:25:05Z",
  "published": "2026-09-17T20:25:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-38p6-h87p-r4cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72701"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-timing-attack-via-verifynonce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-25332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-19T10:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).",
  "id": "GHSA-3jg7-ghg4-5pxr",
  "modified": "2024-02-16T21:31:31Z",
  "published": "2023-10-19T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25332"
    },
    {
      "type": "WEB",
      "url": "https://tetraburst.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-9537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T16:17:20Z",
    "severity": "MODERATE"
  },
  "details": "Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.\n\nThe decode() method compares the supplied signature to the recomputed HMAC with Perl\u0027s eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.\n\nA caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.",
  "id": "GHSA-3rp9-gq85-w2mf",
  "modified": "2026-07-20T21:31:43Z",
  "published": "2026-07-17T18:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9537"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jberger/Mojo-JWT/commit/b8aefb846613e44b5b12bc170898ffd5b05094a2.patch"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/17/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.ongres.scram:scram-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208",
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-16T22:20:08Z",
    "nvd_published_at": "2025-09-22T20:15:38Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because `Arrays.equals` was used to compare secret values such as client proofs and server signatures. Since `Arrays.equals` performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.\n\n### Patches\n\nThis vulnerability has been patched by replacing `Arrays.equals` with `MessageDigest.isEqual`, which ensures constant-time comparison.\n\nUsers should upgrade to version **3.2** or later to mitigate this issue.\n\n### Workarounds\n\nBecause the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).\n\n### References\n\n- [Java `MessageDigest.isEqual` Documentation](https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[]))",
  "id": "GHSA-3wfh-36rx-9537",
  "modified": "2026-01-23T17:28:00Z",
  "published": "2025-09-16T22:20:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3"
    },
    {
      "type": "WEB",
      "url": "https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ongres/scram"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Timing Attack Vulnerability in SCRAM Authentication"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cryptography"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208",
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-05T23:04:50Z",
    "nvd_published_at": "2024-02-05T21:15:11Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.",
  "id": "GHSA-3ww4-gg4f-jr7f",
  "modified": "2026-02-27T20:57:35Z",
  "published": "2024-02-05T21:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/issues/9785"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-50782"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyca/cryptography"
    },
    {
      "type": "WEB",
      "url": "https://www.couchbase.com/alerts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Python Cryptography package vulnerable to Bleichenbacher timing oracle attack"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@sync-in/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-15T18:57:50Z",
    "nvd_published_at": "2026-05-08T14:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe `/api/auth/login` endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application\u0027s response time.\n\n### Details\nThe logic flaw can be located at the below point in source:\nhttps://github.com/Sync-in/server/blob/7868bb2b3025f92e6c38087456304758713971b2/backend/src/applications/users/services/users-queries.service.ts#L91-L95\n\nEndpoints used for authentication should respond to the user with a consistent cadence, preventing remote actors from deriving sensitive information about an application based on backend behavior. In the case of authentication endpoints, this timing discrepancy is often caused by short-circuiting due to the lack of a matched user to compare against - as is the case with Sync-in.\n\n### Validation\nTickTock Enum (Burp Suite Extension) was utilized to validate this finding. Authentication attempts with a valid username see a response from the application at around 350-400ms on average, while invalid usernames are returned at only 95-100ms on average.\n\u003cimg width=\"1302\" height=\"284\" alt=\"image\" src=\"https://github.com/user-attachments/assets/31eeb72a-c3c2-4057-ac69-c0c92f0bbd4e\" /\u003e\n\n### Impact\nAn unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the application\u0027s security posture by facilitating targeted brute-force attacks, stuffing, social engineering, and a suite of other more targeted attacks.",
  "id": "GHSA-43fj-qp3h-hrh5",
  "modified": "2026-05-12T13:31:20Z",
  "published": "2026-04-15T18:57:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sync-in/server/security/advisories/GHSA-43fj-qp3h-hrh5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41161"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sync-in/server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sync-in/server/releases/tag/v2.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Sync-in Server has Username Enumeration via Timing Attack"
}