RansomLook CVE-2026-78551

Username enumeration requires no special conditions - the timing discrepancy is an inherent consequence of the pre-patch short-circuit logic and is measurable over any network path to /login without authentication. Brute-force and credential-stuffing require network access to /login and knowledge of at least one valid username (obtainable via the timing attack); no authentication, session, or application-level token is needed. The DoS path requires a sustained high-rate flood of login attempts targeting valid usernames; the synchronous Gunicorn worker model is a deployment characteristic rather than a configurable option, meaning this is a structural precondition present in all standard RansomLook deployments rather than an operator choice. A critical compounding condition: the nginx misconfiguration (X_FORWARDED_PROTO forwarded with underscores, silently dropped) meant the application could never derive a trustworthy client IP address, which would have made any IP-based rate-limiting control bypassable even if it had existed pre-patch. All three paths require PR:N - no authentication is needed to initiate exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates fully remote, unauthenticated exploitation with no prerequisites, which aligns with the description - all three attack paths require only network reachability to the /login endpoint. The confidentiality impact (VC:L) reflects username enumeration rather than credential or data exposure, while the availability impact (VA:H) is credible given that Gunicorn synchronous workers are a well-understood finite resource: each login attempt against a valid account pins one worker for ~60ms, so a modest flood can saturate a typical worker pool. No EPSS score was supplied in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC were identified, suggesting exploitation has not yet been observed at scale. However, the absence of any rate limiting or timing protection in the pre-patch code makes all three vectors trivially exploitable by any attacker who can reach the endpoint - no special tooling beyond a standard HTTP client is required. The compounding nginx misconfiguration means that the timing and brute-force weaknesses were not independently mitigable through standard WAF or proxy-layer controls prior to the fix, elevating practical risk beyond what raw CVSS might imply for a niche tool.

An attacker sends rapid POST requests to the /login endpoint, varying the username field while holding the password constant, and measures HTTP response latencies: responses returning in under 10ms indicate nonexistent usernames while responses taking 50-80ms (the KDF cost) identify valid accounts. Armed with the enumerated account list, the attacker replays a credential-stuffing wordlist against valid usernames using a standard tool such as Hydra or ffuf; no throttling prevents unlimited attempts. Independently, the attacker floods /login with valid usernames at a high request rate, pinning all Gunicorn synchronous workers on KDF computations and rendering the entire RansomLook application unavailable to legitimate operators.