Picsou Finance
Monthly
Picsou's `/api/auth/login` endpoint returns measurably different response times for valid versus invalid usernames, letting an unauthenticated remote attacker enumerate account names by timing requests. The discrepancy arises because unknown usernames short-circuit to a `BadCredentialsException` before the bcrypt comparison, while existing usernames pay the full bcrypt cost - the reporter measured a stable ~20× gap (roughly 300-450 ms versus 15-25 ms) despite both paths returning identical generic HTTP 401 responses. A working public PoC script exists and was confirmed against a local instance; the vendor shipped a fix in release 1.0.8 that performs a dummy bcrypt comparison on the unknown-user path. Practical exposure is limited by built-in login rate limiting, the tiny user population of a self-hosted personal finance dashboard, and the fact that many deployments are only reachable from the local network.
Picsou's `/api/auth/login` endpoint returns measurably different response times for valid versus invalid usernames, letting an unauthenticated remote attacker enumerate account names by timing requests. The discrepancy arises because unknown usernames short-circuit to a `BadCredentialsException` before the bcrypt comparison, while existing usernames pay the full bcrypt cost - the reporter measured a stable ~20× gap (roughly 300-450 ms versus 15-25 ms) despite both paths returning identical generic HTTP 401 responses. A working public PoC script exists and was confirmed against a local instance; the vendor shipped a fix in release 1.0.8 that performs a dummy bcrypt comparison on the unknown-user path. Practical exposure is limited by built-in login rate limiting, the tiny user population of a self-hosted personal finance dashboard, and the fact that many deployments are only reachable from the local network.