CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85
https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta
https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w
https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) FileBrowser Quantum es un gestor de archivos web gratuito y autoalojado. Antes de la versión 1.3.2-beta, el endpoint de autenticación “/api/auth/login” no se ejecuta en tiempo constante. Cuando se proporciona un nombre de usuario inexistente, el servidor devuelve una respuesta ’401’/’403’ casi inmediatamente. Cuando se proporciona un nombre de usuario válido, el servidor realiza una comparación de contraseñas bcrypt, causando un retraso medible en el tiempo de respuesta. La versión 1.3.2-beta corrige el problema.

Information

Published : 2026-07-20 15:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-54685

Mitre link : CVE-2026-54685

CVE.ORG link : CVE-2026-54685

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-54685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54685", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T15:30:56.605410Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gtsteffaniak", "product": "filebrowser", "versions": [{"status": "affected", "version": "< 1.3.2-beta"}]}]}], "published": "2026-07-20T15:16:43.787", "references": [{"url": "https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85", "source": "security-advisories@github.com"}, {"url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta", "source": "security-advisories@github.com"}, {"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w", "source": "security-advisories@github.com"}, {"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue."}, {"lang": "es", "value": "FileBrowser Quantum es un gestor de archivos web gratuito y autoalojado. Antes de la versi\u00f3n 1.3.2-beta, el endpoint de autenticaci\u00f3n \u201c/api/auth/login\u201d no se ejecuta en tiempo constante. Cuando se proporciona un nombre de usuario inexistente, el servidor devuelve una respuesta \u2019401\u2019/\u2019403\u2019 casi inmediatamente. Cuando se proporciona un nombre de usuario v\u00e1lido, el servidor realiza una comparaci\u00f3n de contrase\u00f1as bcrypt, causando un retraso medible en el tiempo de respuesta. La versi\u00f3n 1.3.2-beta corrige el problema."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}