CWE-208
AllowedObservable Timing Discrepancy
Abstraction: Base · Status: Incomplete
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
356 vulnerabilities reference this CWE, most recent first.
GHSA-VG5X-6Q66-RVGX
Vulnerability from github – Published: 2023-01-08 18:30 – Updated: 2023-01-13 21:05A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 3e7d29dc0ca6c054a6d6e211f32dae89078594c1. It is recommended to upgrade the affected component. VDB-217650 is the identifier assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "barzahlen/barzahlen-php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-15015"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-13T21:05:08Z",
"nvd_published_at": "2023-01-08T18:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function `verify` of the file `src/Webhook.php`. The manipulation leads to observable timing discrepancy. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 3e7d29dc0ca6c054a6d6e211f32dae89078594c1. It is recommended to upgrade the affected component. VDB-217650 is the identifier assigned to this vulnerability.",
"id": "GHSA-vg5x-6q66-rvgx",
"modified": "2023-01-13T21:05:08Z",
"published": "2023-01-08T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-15015"
},
{
"type": "WEB",
"url": "https://github.com/viafintech/Barzahlen-PHP/pull/8"
},
{
"type": "WEB",
"url": "https://github.com/viafintech/Barzahlen-PHP/commit/3e7d29dc0ca6c054a6d6e211f32dae89078594c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/viafintech/Barzahlen-PHP"
},
{
"type": "WEB",
"url": "https://github.com/viafintech/Barzahlen-PHP/releases/tag/v2.0.1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217650"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217650"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy"
}
GHSA-VJ7F-9Q44-G5XV
Vulnerability from github – Published: 2026-08-27 21:31 – Updated: 2026-08-27 21:31Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
{
"affected": [],
"aliases": [
"CVE-2026-59276"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T20:17:53Z",
"severity": "MODERATE"
},
"details": "Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25",
"id": "GHSA-vj7f-9q44-g5xv",
"modified": "2026-08-27T21:31:37Z",
"published": "2026-08-27T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59276"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-59276"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VJF7-9XRV-FJRQ
Vulnerability from github – Published: 2024-05-22 06:30 – Updated: 2024-05-22 06:30Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-35165"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T06:15:09Z",
"severity": "MODERATE"
},
"details": "Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.",
"id": "GHSA-vjf7-9xrv-fjrq",
"modified": "2024-05-22T06:30:38Z",
"published": "2024-05-22T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35165"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VQ4H-9GHM-QMRR
Vulnerability from github – Published: 2023-03-30 03:30 – Updated: 2023-04-07 19:23HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-25000"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-07T19:23:01Z",
"nvd_published_at": "2023-03-30T01:15:00Z",
"severity": "MODERATE"
},
"details": "HashiCorp Vault\u0027s implementation of Shamir\u0027s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
"id": "GHSA-vq4h-9ghm-qmrr",
"modified": "2023-04-07T19:23:01Z",
"published": "2023-03-30T03:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25000"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/pull/19495"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/vault"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230526-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "HashiCorp Vault\u0027s implementation of Shamir\u0027s secret sharing vulnerable to cache-timing attacks"
}
GHSA-VQXH-445G-37FC
Vulnerability from github – Published: 2026-01-22 21:33 – Updated: 2026-01-22 22:33The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.3.8"
},
{
"fixed": "6.3.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.8"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.4.4"
},
{
"fixed": "6.4.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.4.4"
]
}
],
"aliases": [
"CVE-2025-22234"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-22T22:33:22Z",
"nvd_published_at": "2026-01-22T21:15:49Z",
"severity": "MODERATE"
},
"details": "The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.",
"id": "GHSA-vqxh-445g-37fc",
"modified": "2026-01-22T22:33:22Z",
"published": "2026-01-22T21:33:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22234"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-security"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2025-22234"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide"
}
GHSA-VXF7-QJ7Q-83FH
Vulnerability from github – Published: 2026-04-22 06:30 – Updated: 2026-04-29 20:48Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "5.7.0"
},
{
"last_affected": "5.7.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "5.8.0"
},
{
"last_affected": "5.8.24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.3.0"
},
{
"last_affected": "6.3.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.4.0"
},
{
"last_affected": "6.4.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.5.9"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "6.5.0"
},
{
"fixed": "6.5.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.4"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22746"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T20:48:02Z",
"nvd_published_at": "2026-04-22T06:16:02Z",
"severity": "LOW"
},
"details": "Vulnerability in Spring Spring Security. If an application is using the\u00a0UserDetails#isEnabled,\u00a0#isAccountNonExpired, or\u00a0#isAccountNonLocked\u00a0user attributes, to enable, expire, or lock users, then\u00a0DaoAuthenticationProvider\u0027s timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.",
"id": "GHSA-vxf7-qj7q-83fh",
"modified": "2026-04-29T20:48:02Z",
"published": "2026-04-22T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22746"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-security"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-22746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider"
}
GHSA-W2GX-4FH8-WM9F
Vulnerability from github – Published: 2024-03-07 00:30 – Updated: 2025-04-02 18:30A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
{
"affected": [],
"aliases": [
"CVE-2024-2236"
],
"database_specific": {
"cwe_ids": [
"CWE-208",
"CWE-385"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-06T22:15:57Z",
"severity": "MODERATE"
},
"details": "A timing-based side-channel flaw was found in libgcrypt\u0027s RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.",
"id": "GHSA-w2gx-4fh8-wm9f",
"modified": "2025-04-02T18:30:47Z",
"published": "2024-03-07T00:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2236"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9404"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3530"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3534"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-2236"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245218"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268268"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W322-W9FV-RX3M
Vulnerability from github – Published: 2024-04-04 15:30 – Updated: 2024-04-04 15:30A timing-based side-channel exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
{
"affected": [],
"aliases": [
"CVE-2024-3296"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-04T14:15:11Z",
"severity": "MODERATE"
},
"details": "A timing-based side-channel exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.",
"id": "GHSA-w322-w9fv-rx3m",
"modified": "2024-04-04T15:30:34Z",
"published": "2024-04-04T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3296"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-3296"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269723"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W4CX-V96X-C4G8
Vulnerability from github – Published: 2023-01-07 12:30 – Updated: 2023-01-12 18:30A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The name of the patch is fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2014-125056"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-07T10:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The name of the patch is fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.",
"id": "GHSA-w4cx-v96x-c4g8",
"modified": "2023-01-12T18:30:28Z",
"published": "2023-01-07T12:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-125056"
},
{
"type": "WEB",
"url": "https://github.com/Pylons/horus/commit/fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217598"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217598"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6M9-39CV-2FWP
Vulnerability from github – Published: 2026-04-13 19:31 – Updated: 2026-04-24 20:37Summary
A timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. Requests for valid usernames take noticeably longer because the server performs bcrypt password verification, while requests for nonexistent usernames return much faster. This enables reliable remote username enumeration and increases the risk of targeted credential attacks.
Details
The issue affects the login endpoint:
POST /api/auth/token
The root cause is that authentication processing takes different code paths depending on whether the supplied username exists. When the username is found, the server performs bcrypt.CompareHashAndPassword, which adds substantial latency. When the username does not exist, the server returns immediately without performing an equivalent bcrypt operation.
Vulnerable flow:
user, err := db.Where("username = ?", username).First(&user)
if err != nil {
return ErrUnauthorized
}
err = bcrypt.CompareHashAndPassword(user.PasswordHash, []byte(password))
This creates a measurable timing discrepancy between: - existing username + wrong password requests, which incur bcrypt cost - nonexistent username + any password requests, which avoid bcrypt entirely
Because no constant-time equalization is performed, the endpoint leaks account existence through timing behavior.
The measurements provided show a large and consistent gap between the two cases across repeated trials, making the difference distinguishable without requiring especially high request volume. In the supplied test results:
- existing user requests averaged about 0.0616s
- nonexistent user requests averaged about 0.0027s
That gap is large enough to support reliable username enumeration under typical testing conditions.
PoC
The issue can be reproduced by sending repeated authentication attempts to the login endpoint using the same invalid password while alternating between a known valid username and a nonexistent username, then comparing average response times. Valid usernames consistently take longer because bcrypt verification is performed.
Impact
- Type: Timing side-channel / username enumeration
- Who is impacted: Any deployment exposing the affected login endpoint
- Security impact: Unauthenticated attackers can confirm valid usernames one at a time, improving the effectiveness of credential stuffing, password spraying, phishing, and other targeted account attacks
- Attack preconditions: None beyond network access to the login endpoint
- Confidentiality impact: Low to moderate, depending on the sensitivity of account existence in the target environment
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/enchant97/note-mark/backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.19.2-0.20260411145025-cf4c6f6acf70"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40263"
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-13T19:31:50Z",
"nvd_published_at": "2026-04-17T01:17:40Z",
"severity": "LOW"
},
"details": "### Summary\nA timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. Requests for valid usernames take noticeably longer because the server performs bcrypt password verification, while requests for nonexistent usernames return much faster. This enables reliable remote username enumeration and increases the risk of targeted credential attacks.\n\n### Details\nThe issue affects the login endpoint:\n\n- `POST /api/auth/token`\n\nThe root cause is that authentication processing takes different code paths depending on whether the supplied username exists. When the username is found, the server performs `bcrypt.CompareHashAndPassword`, which adds substantial latency. When the username does not exist, the server returns immediately without performing an equivalent bcrypt operation.\n\nVulnerable flow:\n\n```go\nuser, err := db.Where(\"username = ?\", username).First(\u0026user)\nif err != nil {\n return ErrUnauthorized\n}\nerr = bcrypt.CompareHashAndPassword(user.PasswordHash, []byte(password))\n```\n\nThis creates a measurable timing discrepancy between:\n- **existing username + wrong password** requests, which incur bcrypt cost\n- **nonexistent username + any password** requests, which avoid bcrypt entirely\n\nBecause no constant-time equalization is performed, the endpoint leaks account existence through timing behavior.\n\nThe measurements provided show a large and consistent gap between the two cases across repeated trials, making the difference distinguishable without requiring especially high request volume. In the supplied test results:\n- existing user requests averaged about `0.0616s`\n- nonexistent user requests averaged about `0.0027s`\n\nThat gap is large enough to support reliable username enumeration under typical testing conditions.\n\n### PoC\nThe issue can be reproduced by sending repeated authentication attempts to the login endpoint using the same invalid password while alternating between a known valid username and a nonexistent username, then comparing average response times. Valid usernames consistently take longer because bcrypt verification is performed.\n\n### Impact\n- **Type:** Timing side-channel / username enumeration\n- **Who is impacted:** Any deployment exposing the affected login endpoint\n- **Security impact:** Unauthenticated attackers can confirm valid usernames one at a time, improving the effectiveness of credential stuffing, password spraying, phishing, and other targeted account attacks\n- **Attack preconditions:** None beyond network access to the login endpoint\n- **Confidentiality impact:** Low to moderate, depending on the sensitivity of account existence in the target environment",
"id": "GHSA-w6m9-39cv-2fwp",
"modified": "2026-04-24T20:37:10Z",
"published": "2026-04-13T19:31:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40263"
},
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034"
},
{
"type": "PACKAGE",
"url": "https://github.com/enchant97/note-mark"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel"
}
No mitigation information available for this CWE.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-541: Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
CAPEC-580: System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.