This vulnerability in Portainer CE 2.19.4 allows remote unauthenticated users to enumerate valid usernames by measuring differences in response times during authentication attempts. The flaw is categorized under CWE-286 (Improper Authentication). The CVSS 3.1 vector indicates the attack is network-based, requires no privileges or user interaction, and impacts confidentiality with limited information disclosure. There is no indication of integrity or availability impact. No known exploits are reported in the wild, and no patch or remediation details are provided.

An attacker can remotely determine valid usernames on the affected Portainer CE 2.19.4 instance by analyzing response time differences during login attempts. This information disclosure can aid in further targeted attacks such as password guessing or social engineering. There is no direct impact on data integrity or system availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider implementing compensating controls such as rate limiting login attempts or monitoring for suspicious authentication behavior to reduce the risk of user enumeration.