Timing Discrepancy in Picsou's Authentication Process Affects User Data Security

CVE-2026-62860

What is CVE-2026-62860?

The vulnerability in Picsou's authentication process occurs at the /api/auth/login endpoint where timing discrepancies can reveal valid usernames. Specifically, the implementation quickly responds with an error for unknown usernames, while valid usernames with incorrect passwords extend response times due to bcrypt comparison costs. This unequal response timing can be exploited, allowing attackers to enumerate usernames, which could facilitate further attacks such as credential stuffing. The underlying issue has been addressed in the release version 1.0.8, thereby enhancing security.

References