4gaBoards prior to version 3.3.5 is vulnerable to user enumeration via a timing side-channel in its login API endpoint (/api/access-tokens). When an invalid username or email is submitted, the server returns a response in about 17 milliseconds on average. However, when a valid username/email is submitted with an incorrect password, the server performs a bcrypt.compareSync() operation that takes approximately 74 milliseconds before responding. This creates a measurable timing discrepancy (~4.4× difference) that allows attackers to distinguish valid usernames from invalid ones by measuring response times. This vulnerability is identified as CWE-208 and has a CVSS 3.1 base score of 5.3, indicating medium severity. The vulnerability is resolved in version 3.3.5 of 4gaBoards.

An attacker can enumerate valid usernames or email addresses on vulnerable versions of 4gaBoards by exploiting the timing discrepancy in the login endpoint. This information disclosure can aid further targeted attacks such as phishing or brute force attempts. The vulnerability does not impact confidentiality of passwords or system integrity directly, nor does it affect availability. There are no known exploits in the wild at this time.

Upgrade 4gaBoards to version 3.3.5 or later, where this timing side-channel vulnerability has been fixed. Since no official patch link or advisory is provided, verify the upgrade through the vendor's official release notes or update channels. No additional mitigation is indicated or required beyond applying the fixed version.