User Enumeration Vulnerability in 4ga Boards by RARgames

CVE-2026-41418

What is CVE-2026-41418?

4ga Boards, a project management system by RARgames, contains a user enumeration vulnerability in its login mechanism before version 3.3.5. Exploitation of this vulnerability occurs through a timing side-channel attack on the login endpoint, where discrepancies in response times can reveal valid usernames or emails. Specifically, when an invalid username or email is used, the server responds quickly, averaging around 17 milliseconds. In contrast, a valid username with an incorrect password triggers a slower response due to bcrypt comparison operations, averaging approximately 74 milliseconds. This noticeable difference (~4.4 times longer) can be easily detected and exploited over a network, threatening user account security. The issue was remediated in version 3.3.5.

References