CVE-2026-8794

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

CVSS

No CVSS.

References

Link	Resource
https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) PaperCut NG/MF contiene una discrepancia de tiempo observable en su componente de autenticación. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para realizar enumeración de nombres de usuario midiendo los tiempos de respuesta durante los intentos de inicio de sesión. El sistema ejecuta una comparación de hash de contraseña solo cuando se proporciona una cuenta válida, creando un oráculo de tiempo medible que revela la existencia de la cuenta.

Information

Published : 2026-08-03 08:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-8794

Mitre link : CVE-2026-8794

CVE.ORG link : CVE-2026-8794

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-8794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8794", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T14:29:59.343562Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "affectedData": [{"vendor": "PaperCut", "product": "PaperCut NG/MF", "versions": [{"status": "affected", "version": "0", "lessThan": "26.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-03T08:17:21.273", "references": [{"url": "https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "eb41dac7-0af8-4f84-9f6d-0272772514f4", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence."}, {"lang": "es", "value": "PaperCut NG/MF contiene una discrepancia de tiempo observable en su componente de autenticaci\u00f3n. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para realizar enumeraci\u00f3n de nombres de usuario midiendo los tiempos de respuesta durante los intentos de inicio de sesi\u00f3n. El sistema ejecuta una comparaci\u00f3n de hash de contrase\u00f1a solo cuando se proporciona una cuenta v\u00e1lida, creando un or\u00e1culo de tiempo medible que revela la existencia de la cuenta."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "eb41dac7-0af8-4f84-9f6d-0272772514f4"}