Logic Flaw in File Browser Allows Unauthenticated User Enumeration by XYZ Company

CVE-2026-23849

What is CVE-2026-23849?

The File Browser product by XYZ Company has a vulnerability in its authentication process that enables unauthenticated attackers to enumerate valid usernames via timing discrepancies in response from the /api/login endpoint. Prior to version 2.55.0, a flaw in the JSONAuth.Auth function causes a different execution duration based on the existence of a username. When an unknown username is queried, the function terminates quickly. Conversely, if the username exists, it engages an intensive password verification step, creating a measurable time delay. This timing difference can be exploited by attackers to identify valid usernames. Version 2.55.0 rectifies this issue with a patch.

References