Common Weakness Enumeration
CWE-208
AllowedObservable Timing Discrepancy
Abstraction: Base · Status: Incomplete
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
194 vulnerabilities reference this CWE, most recent first.
CVE-2026-74846 (GCVE-0-2026-74846)
Vulnerability from cvelistv5 – Published: 2026-11-03 07:51 – Updated: 2026-11-06 18:42
VLAI
EPSS
VEX
Title
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Summary
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.
CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
A remote attacker can use response-time differences to guess the stored password or hash.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:42 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
CPANSec
CNA
References
3 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-74846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:42:32.907151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:42:56.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Catalyst::Plugin::Authentication"
],
"packageName": "Catalyst-Plugin-Authentication",
"packageURL": "pkg:cpan/Catalyst-Plugin-Authentication",
"programFiles": [
"lib/Catalyst/Plugin/Authentication/Credential/Password.pm"
],
"programRoutines": [
{
"name": "Catalyst::Plugin::Authentication::Credential::Password::_check_password"
}
],
"repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication",
"versions": [
{
"lessThan": "0.10029",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208 Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T07:51:25.290Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes"
},
{
"tags": [
"patch"
],
"url": "https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5091"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Catalyst-Plugin-Authentication 0.10029 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-74846",
"datePublished": "2026-11-03T07:51:25.290Z",
"dateReserved": "2026-08-17T06:30:29.057Z",
"dateUpdated": "2026-11-06T18:42:56.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72701 (GCVE-0-2026-72701)
Vulnerability from cvelistv5 – Published: 2026-08-25 01:30 – Updated: 2026-10-08 15:24
VLAI
EPSS
VEX
Title
Grav CMS before 2.0.16 Timing Attack via verifyNonce
Summary
Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, weakening CSRF protection below its intended security margin.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:53 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/grav-cms-bef… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72701",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:53:40.236596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:54:28.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-38p6-h87p-r4cg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/getgrav/grav",
"product": "grav",
"vendor": "getgrav",
"versions": [
{
"lessThan": "2.0.16",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.0.16",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alham-rizvi"
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, weakening CSRF protection below its intended security margin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:24:24.438Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-38p6-h87p-r4cg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-38p6-h87p-r4cg"
},
{
"name": "VulnCheck Advisory: Grav CMS before 2.0.16 Timing Attack via verifyNonce",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-cms-before-timing-attack-via-verifynonce"
}
],
"title": "Grav CMS before 2.0.16 Timing Attack via verifyNonce",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72701",
"datePublished": "2026-08-25T01:30:23.965Z",
"dateReserved": "2026-08-10T13:02:20.829Z",
"dateUpdated": "2026-10-08T15:24:24.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72700 (GCVE-0-2026-72700)
Vulnerability from cvelistv5 – Published: 2026-08-25 01:30 – Updated: 2026-08-25 17:25
VLAI
EPSS
VEX
Title
Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison
Summary
The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 17:25 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/grav-before-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72700",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T17:25:29.731150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T17:25:36.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-x239-6jqx-5hjh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav",
"vendor": "getgrav",
"versions": [
{
"lessThan": "3.9.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alham-rizvi"
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting, an attacker could in principle send repeated token guesses against a known username and use the timing differences to attempt to recover a valid token, though the vendor rates the practical exploitability as low and no end-to-end network exploit has been demonstrated."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T01:30:22.914Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x239-6jqx-5hjh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-x239-6jqx-5hjh"
},
{
"name": "VulnCheck Advisory: Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-before-timing-attack-via-non-constant-time-token-comparison"
}
],
"title": "Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72700",
"datePublished": "2026-08-25T01:30:22.914Z",
"dateReserved": "2026-08-10T13:02:20.829Z",
"dateUpdated": "2026-08-25T17:25:36.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70658 (GCVE-0-2026-70658)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:14 – Updated: 2026-09-14 18:57
VLAI
EPSS
VEX
Title
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Summary
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:57 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pay-rails/pay/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pay-rails/pay/commit/ba6494109… | x_refsource_MISC |
| https://github.com/pay-rails/pay/releases/tag/v11.6.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70658",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:57:23.905589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:57:30.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pay",
"vendor": "pay-rails",
"versions": [
{
"status": "affected",
"version": "\u003c 11.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:14:57.207Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pay-rails/pay/security/advisories/GHSA-mjgf-xj26-9qf9"
},
{
"name": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/commit/ba6494109d88209fba2a4df2d9d6373fe81ed805"
},
{
"name": "https://github.com/pay-rails/pay/releases/tag/v11.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pay-rails/pay/releases/tag/v11.6.2"
}
],
"source": {
"advisory": "GHSA-mjgf-xj26-9qf9",
"discovery": "UNKNOWN"
},
"title": "pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70658",
"datePublished": "2026-09-14T17:14:57.207Z",
"dateReserved": "2026-08-04T21:48:08.613Z",
"dateUpdated": "2026-09-14T18:57:30.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69247 (GCVE-0-2026-69247)
Vulnerability from cvelistv5 – Published: 2026-08-03 21:16 – Updated: 2026-08-04 14:09
VLAI
EPSS
VEX
Title
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
Summary
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 14:09 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pyca/cryptography/security/adv… | x_refsource_CONFIRM |
| https://github.com/pyca/cryptography/pull/15369 | x_refsource_MISC |
| https://github.com/pyca/cryptography/commit/53fcc… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pyca | cryptography |
Affected:
>= 44.0.0, < 50.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T14:09:18.204828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T14:09:24.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cryptography",
"vendor": "pyca",
"versions": [
{
"status": "affected",
"version": "\u003e= 44.0.0, \u003c 50.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo\u0027s encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:16:32.047Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5"
},
{
"name": "https://github.com/pyca/cryptography/pull/15369",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/cryptography/pull/15369"
},
{
"name": "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"
}
],
"source": {
"advisory": "GHSA-g6cj-pr64-35w5",
"discovery": "UNKNOWN"
},
"title": "cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69247",
"datePublished": "2026-08-03T21:16:32.047Z",
"dateReserved": "2026-08-03T19:54:19.852Z",
"dateUpdated": "2026-08-04T14:09:24.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65630 (GCVE-0-2026-65630)
Vulnerability from cvelistv5 – Published: 2026-10-26 19:54 – Updated: 2026-11-02 21:31
VLAI
EPSS
VEX
Title
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
Summary
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback.
The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (jose_jwa_x25519:montgomery_add/3 and jose_jwa_x25519:montgomery_double/1) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points jose_jwa_x25519:scalarmult/2, jose_jwa_x25519:x25519/2, jose_jwa_x25519:x25519_base/1, and jose_jwa_x25519:sk_to_pk/1 is thus a function of the private key.
This path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through JOSE.JWK.box_decrypt_ecdh_es/2, which reaches jose_jwa_curve25519:x25519_shared_secret/2 and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it.
This issue affects jose: from 1.10.0 before 1.11.13.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 21:31 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
EEF
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/potatosalad/erlang-jose/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65630.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65630 | related |
| https://github.com/potatosalad/erlang-jose/commit… | related |
| https://github.com/potatosalad/erlang-jose/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| potatosalad | jose |
Affected:
1.10.0 , < 1.11.13
(semver)
cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* |
|
| potatosalad | jose |
Affected:
8e532095de114ef4bf88a9ec5d651fa251a972b3 , < 3670f873c274bba86fb7f5ee5727a7efa1322b79
(git)
cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T21:31:13.096968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T21:31:37.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"jose_jwa_x25519",
"jose_jwa_curve25519",
"jose_curve25519_fallback",
"jose_jwk_kty_okp_x25519"
],
"packageName": "jose",
"packageURL": "pkg:hex/jose",
"product": "jose",
"programFiles": [
"src/jwa/jose_jwa_x25519.erl",
"src/jwa/jose_jwa_curve25519.erl",
"src/jwa/curve25519/jose_curve25519_fallback.erl",
"src/jwk/jose_jwk_kty_okp_x25519.erl"
],
"programRoutines": [
{
"name": "jose_jwa_x25519:curve25519/2"
},
{
"name": "jose_jwa_x25519:scalarmult/2"
},
{
"name": "jose_jwa_x25519:scalarmult_base/1"
},
{
"name": "jose_jwa_x25519:x25519/2"
},
{
"name": "jose_jwa_x25519:x25519_base/1"
},
{
"name": "jose_jwa_x25519:sk_to_pk/1"
},
{
"name": "jose_jwa_x25519:montgomery_add/3"
},
{
"name": "jose_jwa_x25519:montgomery_double/1"
},
{
"name": "jose_jwa_curve25519:x25519_shared_secret/2"
},
{
"name": "jose_jwa_curve25519:x25519_secret_to_public/1"
}
],
"repo": "https://github.com/potatosalad/erlang-jose",
"vendor": "potatosalad",
"versions": [
{
"lessThan": "1.11.13",
"status": "affected",
"version": "1.10.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"jose_jwa_x25519",
"jose_jwa_curve25519",
"jose_curve25519_fallback",
"jose_jwk_kty_okp_x25519"
],
"packageName": "potatosalad/erlang-jose",
"packageURL": "pkg:github/potatosalad/erlang-jose",
"product": "jose",
"programFiles": [
"src/jwa/jose_jwa_x25519.erl",
"src/jwa/jose_jwa_curve25519.erl",
"src/jwa/curve25519/jose_curve25519_fallback.erl",
"src/jwk/jose_jwk_kty_okp_x25519.erl"
],
"programRoutines": [
{
"name": "jose_jwa_x25519:curve25519/2"
},
{
"name": "jose_jwa_x25519:scalarmult/2"
},
{
"name": "jose_jwa_x25519:scalarmult_base/1"
},
{
"name": "jose_jwa_x25519:x25519/2"
},
{
"name": "jose_jwa_x25519:x25519_base/1"
},
{
"name": "jose_jwa_x25519:sk_to_pk/1"
},
{
"name": "jose_jwa_x25519:montgomery_add/3"
},
{
"name": "jose_jwa_x25519:montgomery_double/1"
},
{
"name": "jose_jwa_curve25519:x25519_shared_secret/2"
},
{
"name": "jose_jwa_curve25519:x25519_secret_to_public/1"
}
],
"repo": "https://github.com/potatosalad/erlang-jose",
"vendor": "potatosalad",
"versions": [
{
"lessThan": "3670f873c274bba86fb7f5ee5727a7efa1322b79",
"status": "affected",
"version": "8e532095de114ef4bf88a9ec5d651fa251a972b3",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is only exploitable when X25519 private-key operations run through the pure-Erlang Curve25519 fallback, for example when the crypto fallback is enabled (\u003ccode\u003eJOSE.crypto_fallback(true)\u003c/code\u003e or \u003ccode\u003eJOSE.curve25519_module(:jose_jwa_curve25519)\u003c/code\u003e) or when no constant-time native X25519 implementation (a libsodium or libdecaf NIF, or the OTP \u003ccode\u003ecrypto\u003c/code\u003e application providing \u003ccode\u003ex25519\u003c/code\u003e) is available. Deployments that use a constant-time native X25519 are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The vulnerability is only exploitable when X25519 private-key operations run through the pure-Erlang Curve25519 fallback, for example when the crypto fallback is enabled (`JOSE.crypto_fallback(true)` or `JOSE.curve25519_module(:jose_jwa_curve25519)`) or when no constant-time native X25519 implementation (a libsodium or libdecaf NIF, or the OTP `crypto` application providing `x25519`) is available. Deployments that use a constant-time native X25519 are not affected."
}
],
"value": "The vulnerability is only exploitable when X25519 private-key operations run through the pure-Erlang Curve25519 fallback, for example when the crypto fallback is enabled (JOSE.crypto_fallback(true) or JOSE.curve25519_module(:jose_jwa_curve25519)) or when no constant-time native X25519 implementation (a libsodium or libdecaf NIF, or the OTP crypto application providing x25519) is available. Deployments that use a constant-time native X25519 are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11.13",
"versionStartIncluding": "1.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrew Bennett"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eObservable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback.\u003c/p\u003e\n\u003cp\u003eThe pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (\u003ccode\u003ejose_jwa_x25519:curve25519/2\u003c/code\u003e) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (\u003ccode\u003ejose_jwa_x25519:montgomery_add/3\u003c/code\u003e and \u003ccode\u003ejose_jwa_x25519:montgomery_double/1\u003c/code\u003e) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points \u003ccode\u003ejose_jwa_x25519:scalarmult/2\u003c/code\u003e, \u003ccode\u003ejose_jwa_x25519:x25519/2\u003c/code\u003e, \u003ccode\u003ejose_jwa_x25519:x25519_base/1\u003c/code\u003e, and \u003ccode\u003ejose_jwa_x25519:sk_to_pk/1\u003c/code\u003e is thus a function of the private key.\u003c/p\u003e\n\u003cp\u003eThis path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through \u003ccode\u003eJOSE.JWK.box_decrypt_ecdh_es/2\u003c/code\u003e, which reaches \u003ccode\u003ejose_jwa_curve25519:x25519_shared_secret/2\u003c/code\u003e and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it.\u003c/p\u003e\n\u003cp\u003eThis issue affects jose: from 1.10.0 before 1.11.13.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback.\n\nThe pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (`jose_jwa_x25519:curve25519/2`) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (`jose_jwa_x25519:montgomery_add/3` and `jose_jwa_x25519:montgomery_double/1`) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points `jose_jwa_x25519:scalarmult/2`, `jose_jwa_x25519:x25519/2`, `jose_jwa_x25519:x25519_base/1`, and `jose_jwa_x25519:sk_to_pk/1` is thus a function of the private key.\n\nThis path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through `JOSE.JWK.box_decrypt_ecdh_es/2`, which reaches `jose_jwa_curve25519:x25519_shared_secret/2` and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it.\n\nThis issue affects jose: from 1.10.0 before 1.11.13."
}
],
"value": "Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback.\n\nThe pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (jose_jwa_x25519:montgomery_add/3 and jose_jwa_x25519:montgomery_double/1) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points jose_jwa_x25519:scalarmult/2, jose_jwa_x25519:x25519/2, jose_jwa_x25519:x25519_base/1, and jose_jwa_x25519:sk_to_pk/1 is thus a function of the private key.\n\nThis path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through JOSE.JWK.box_decrypt_ecdh_es/2, which reaches jose_jwa_curve25519:x25519_shared_secret/2 and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it.\n\nThis issue affects jose: from 1.10.0 before 1.11.13."
}
],
"impacts": [
{
"capecId": "CAPEC-97",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-97 Cryptanalysis"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208 Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:54:07.686Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp"
},
{
"name": "EEF CNA record for CVE-2026-65630",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65630.html"
},
{
"name": "OSV record EEF-CVE-2026-65630",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65630"
},
{
"name": "Introducing commit 8e53209 in potatosalad/erlang-jose",
"tags": [
"related"
],
"url": "https://github.com/potatosalad/erlang-jose/commit/8e532095de114ef4bf88a9ec5d651fa251a972b3"
},
{
"name": "Fix commit 3670f87 in potatosalad/erlang-jose",
"tags": [
"patch"
],
"url": "https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse a constant-time native X25519 implementation for private-key operations: install the libsodium or libdecaf NIF, or run on an OTP release whose \u003ccode\u003ecrypto\u003c/code\u003e application provides \u003ccode\u003ex25519\u003c/code\u003e, and do not force the pure-Erlang Curve25519 fallback (\u003ccode\u003eJOSE.crypto_fallback(true)\u003c/code\u003e or \u003ccode\u003eJOSE.curve25519_module(:jose_jwa_curve25519)\u003c/code\u003e) for long-lived keys.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use a constant-time native X25519 implementation for private-key operations: install the libsodium or libdecaf NIF, or run on an OTP release whose `crypto` application provides `x25519`, and do not force the pure-Erlang Curve25519 fallback (`JOSE.crypto_fallback(true)` or `JOSE.curve25519_module(:jose_jwa_curve25519)`) for long-lived keys."
}
],
"value": "Use a constant-time native X25519 implementation for private-key operations: install the libsodium or libdecaf NIF, or run on an OTP release whose crypto application provides x25519, and do not force the pure-Erlang Curve25519 fallback (JOSE.crypto_fallback(true) or JOSE.curve25519_module(:jose_jwa_curve25519)) for long-lived keys."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65630",
"datePublished": "2026-10-26T19:54:07.686Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-11-02T21:31:37.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63410 (GCVE-0-2026-63410)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:48 – Updated: 2026-11-02 14:50
VLAI
EPSS
VEX
Title
secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication
Summary
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory's broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:49 UTC
CWE
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sgbett/secp256k1-native/securi… | x_refsource_CONFIRM |
| https://github.com/sgbett/secp256k1-native/pull/32 | x_refsource_MISC |
| https://github.com/sgbett/secp256k1-native/commit… | x_refsource_MISC |
| https://github.com/sgbett/secp256k1-native/blob/m… | x_refsource_MISC |
| https://github.com/sgbett/secp256k1-native/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgbett | secp256k1-native |
Affected:
>= 0.17.0, < 0.18.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63410",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:49:39.327340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:50:09.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "secp256k1-native",
"vendor": "sgbett",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.17.0, \u003c 0.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory\u0027s broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1255",
"description": "CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:48:09.173Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sgbett/secp256k1-native/security/advisories/GHSA-vp2j-gqfm-r3cf"
},
{
"name": "https://github.com/sgbett/secp256k1-native/pull/32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sgbett/secp256k1-native/pull/32"
},
{
"name": "https://github.com/sgbett/secp256k1-native/commit/a89bea1617a2d063c6545ad44565dc22098c880e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sgbett/secp256k1-native/commit/a89bea1617a2d063c6545ad44565dc22098c880e"
},
{
"name": "https://github.com/sgbett/secp256k1-native/blob/master/docs/advisories/0001-compiler-reconstructed-ct-branch.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sgbett/secp256k1-native/blob/master/docs/advisories/0001-compiler-reconstructed-ct-branch.md"
},
{
"name": "https://github.com/sgbett/secp256k1-native/releases/tag/v0.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sgbett/secp256k1-native/releases/tag/v0.18.0"
}
],
"source": {
"advisory": "GHSA-vp2j-gqfm-r3cf",
"discovery": "UNKNOWN"
},
"title": "secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63410",
"datePublished": "2026-10-30T22:48:09.173Z",
"dateReserved": "2026-07-16T19:20:28.987Z",
"dateUpdated": "2026-11-02T14:50:09.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63132 (GCVE-0-2026-63132)
Vulnerability from cvelistv5 – Published: 2026-09-23 17:59 – Updated: 2026-09-23 19:16
VLAI
EPSS
VEX
Title
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
Summary
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:13 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openbao/openbao/security/advis… | x_refsource_CONFIRM |
| https://github.com/openbao/openbao/pull/3388 | x_refsource_MISC |
| https://github.com/openbao/openbao/pull/3472 | x_refsource_MISC |
| https://github.com/openbao/openbao/commit/0f2d90c… | x_refsource_MISC |
| https://github.com/openbao/openbao/commit/763625a… | x_refsource_MISC |
| https://github.com/hashicorp/vault/blob/main/CHAN… | x_refsource_MISC |
| https://github.com/openbao/openbao/releases/tag/v2.6.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:13:35.308605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:16:11.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openbao",
"vendor": "openbao",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao\u0027s handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:59:19.639Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53"
},
{
"name": "https://github.com/openbao/openbao/pull/3388",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/pull/3388"
},
{
"name": "https://github.com/openbao/openbao/pull/3472",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/pull/3472"
},
{
"name": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8"
},
{
"name": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a"
},
{
"name": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203"
},
{
"name": "https://github.com/openbao/openbao/releases/tag/v2.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbao/openbao/releases/tag/v2.6.0"
}
],
"source": {
"advisory": "GHSA-34fc-gh42-pj53",
"discovery": "UNKNOWN"
},
"title": "OpenBao\u0027s Recovery Mode Vulnerable To Token Leakage via Timing Attack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63132",
"datePublished": "2026-09-23T17:59:19.639Z",
"dateReserved": "2026-07-15T16:54:55.817Z",
"dateUpdated": "2026-09-23T19:16:11.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62860 (GCVE-0-2026-62860)
Vulnerability from cvelistv5 – Published: 2026-10-30 20:40 – Updated: 2026-11-06 18:18
VLAI
EPSS
VEX
Title
Picsou vulnerable to login timing attack
Summary
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:15 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Cloeille/picsou-finance/securi… | x_refsource_CONFIRM |
| https://github.com/Cloeille/picsou-finance/commit… | x_refsource_MISC |
| https://github.com/Cloeille/picsou-finance/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoeille | picsou-finance |
Affected:
< 1.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62860",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:15:52.514765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:18:00.135Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "picsou-finance",
"vendor": "Zoeille",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:40:46.993Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6"
},
{
"name": "https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59"
},
{
"name": "https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8"
}
],
"source": {
"advisory": "GHSA-ww5m-pxgq-8qq6",
"discovery": "UNKNOWN"
},
"title": "Picsou vulnerable to login timing attack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62860",
"datePublished": "2026-10-30T20:40:46.993Z",
"dateReserved": "2026-07-14T21:10:50.032Z",
"dateUpdated": "2026-11-06T18:18:00.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59218 (GCVE-0-2026-59218)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:53 – Updated: 2026-07-09 17:50
VLAI
EPSS
VEX
Title
Open WebUI: Account enumeration via observable login timing discrepancy
Summary
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than missing-email attempts and allowing unauthenticated account enumeration. This issue is fixed in version 0.10.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 17:50 UTC
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | x_refsource_CONFIRM |
| https://github.com/open-webui/open-webui/pull/26385 | x_refsource_MISC |
| https://github.com/open-webui/open-webui/commit/9… | x_refsource_MISC |
| https://github.com/open-webui/open-webui/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
< 0.10.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T17:50:34.890081Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:50:41.900Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than missing-email attempts and allowing unauthenticated account enumeration. This issue is fixed in version 0.10.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:53:54.653Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7rw5-9f7q-xj36",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7rw5-9f7q-xj36"
},
{
"name": "https://github.com/open-webui/open-webui/pull/26385",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/pull/26385"
},
{
"name": "https://github.com/open-webui/open-webui/commit/993e74912199c66c522f08ec81abe31d76985e39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/commit/993e74912199c66c522f08ec81abe31d76985e39"
},
{
"name": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
}
],
"source": {
"advisory": "GHSA-7rw5-9f7q-xj36",
"discovery": "UNKNOWN"
},
"title": "Open WebUI: Account enumeration via observable login timing discrepancy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59218",
"datePublished": "2026-07-09T15:53:54.653Z",
"dateReserved": "2026-07-02T21:05:02.924Z",
"dateUpdated": "2026-07-09T17:50:41.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-541: Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
CAPEC-580: System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.