A flaw was found in BusyBox's httpd web server. (CVE-2026-88834)

CVE-2026-88834 is a low-severity vulnerability in BusyBox's httpd web server. When configured with system password authentication and certain non-default build options, the server may leak information about valid usernames through differing authentication failure responses. This user existence oracle does not allow password or data compromise but can aid attackers in reconnaissance. Default BusyBox builds using shadow password support are not vulnerable, limiting the scope of affected deployments.

The vulnerability allows an attacker to enumerate valid usernames on the affected system, which is an information disclosure issue. There is no impact on confidentiality, integrity, or availability beyond username enumeration. Exploitation requires non-default compile options or uncommon password file states, reducing the likelihood of widespread impact.

No official patch or fix is currently documented. Since default BusyBox builds with shadow password support are not affected, using default configurations mitigates the issue. Users relying on system password authentication with custom build options should consider disabling this feature or monitoring vendor advisories for future patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.