EUVD-2026-45953
GHSA-7789-65hx-f26w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible login endpoint requires no authentication; impact is limited to username enumeration (C:L) with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
AnalysisAI
Username enumeration via authentication timing side-channel in FileBrowser Quantum's /api/auth/login endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.
Technical ContextAI
The root cause is CWE-208 (Observable Timing Discrepancy) in the Auth function of JSONAuth, located in backend/auth/json.go (lines 45-52) of the FileBrowser Quantum Go backend. The vulnerable code performs a database lookup for the supplied username first; if the username is not found, it returns an error immediately without executing any password validation. If the username exists, it calls CheckPwd, which invokes a bcrypt comparison - an intentionally CPU-expensive operation. Because bcrypt is designed to be slow, its presence or absence in the code path creates a timing differential large enough to measure reliably over a network. CPE cpe:2.3:a:gtsteffaniak:filebrowser:*:*:*:*:*:*:*:* confirms all versions of this product prior to the patch are affected. The fix introduces utils.InvalidPasswordHash (a pre-computed bcrypt hash) as a dummy value so that every authentication attempt, regardless of username validity, always executes the full bcrypt comparison path, equalizing timing.
RemediationAI
Upgrade to FileBrowser Quantum version 1.3.2-beta or later, available at https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta. The patch is implemented in commit af08800667b874620edc6f44c3e2e64fec7abd85, which modifies backend/auth/json.go to always execute bcrypt comparison using utils.InvalidPasswordHash as a dummy hash when the username is not found, eliminating the observable timing difference. If immediate upgrade is not possible, placing a rate-limiting reverse proxy (e.g., nginx limit_req or a WAF rule) in front of the /api/auth/login endpoint will increase the attacker's cost and time for enumeration, though it does not eliminate the timing side-channel itself. Restricting the login endpoint to trusted IP ranges or a VPN is the most effective compensating control, as it prevents unauthenticated network access entirely - the trade-off is reduced accessibility for legitimate remote users.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today