Picsou CVE-2026-62860

Exploitable by an unauthenticated attacker (CVSS PR:N) who can send HTTP POST requests to the /api/auth/login endpoint and observe response latency. The specific prerequisite is that the attacker must be able to distinguish the bcrypt timing cost from baseline - the leak is the ~20× latency difference between the unknown-username path (immediate BadCredentialsException before passwordEncoder.matches) and the valid-username path (which runs the bcrypt comparison). LIMITING factors explicitly stated by the vendor: built-in login rate limiting throttles rapid probing (the PoC itself detects HTTP 429), the user population on a personal self-hosted instance is very small (few usernames to enumerate), and many deployments are not internet-exposed, requiring the attacker to already have LAN access. Network latency/jitter on a remote path can also blur the timing signal, though the measured 20× gap was stable in the reporter's local tests.

This is a genuine but low-priority finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) correctly captures an unauthenticated, network-reachable weakness with only limited confidentiality impact (C:L) and no integrity or availability effect - consistent with CWE-208 username enumeration that leaks which accounts exist but neither reads nor modifies data. The vuln.today decision label is 'this_month' (routine prioritization), not act_now or emergency. No EPSS score and no CISA KEV entry were supplied, so there is no signal of active exploitation; status is therefore 'no public exploit identified' does NOT apply here because a working PoC is present - a full, reporter-confirmed Python timing script with three successful runs showing a stable ~20× latency gap (admin ~0.3-0.45s vs absent ~0.015-0.025s) is published directly in the GHSA advisory. The signals are internally consistent: medium severity, PoC available, no evidence of widespread exploitation, and a self-hosted niche product. The vendor itself rates severity Low, citing three compounding mitigations (login rate limiting, tiny user populations, and deployments that are frequently LAN-only). Net: a real, easily-fixed information-disclosure oracle that assists later credential stuffing/brute force, but not an emergency - the bug is a precursor, not a breach.

An attacker who can reach the Picsou instance (over the internet if exposed, otherwise from the LAN) sends repeated POST requests to /api/auth/login with candidate usernames and an arbitrary wrong password, timing each response. Existing usernames take ~300-450ms (the bcrypt comparison cost) while non-existent ones return in ~15-25ms despite identical HTTP 401 bodies, so the attacker compiles a list of valid accounts. A working PoC script confirming this is published in the GHSA advisory; the enumerated usernames then feed targeted credential-stuffing or brute-force attempts.