Logic Flaw in File Browser Allows Unauthenticated User Enumeration by XYZ Company

CVE-2026-23849

What is CVE-2026-23849?

The File Browser product by XYZ Company has a vulnerability in its authentication process that enables unauthenticated attackers to enumerate valid usernames via timing discrepancies in response from the /api/login endpoint. Prior to version 2.55.0, a flaw in the JSONAuth.Auth function causes a different execution duration based on the existence of a username. When an unknown username is queried, the function terminates quickly. Conversely, if the username exists, it engages an intensive password verification step, creating a measurable time delay. This timing difference can be exploited by attackers to identify valid usernames. Version 2.55.0 rectifies this issue with a patch.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References