The vulnerability in FileBrowser Quantum affects the authentication endpoint /api/auth/login prior to version 1.3.2-beta. When a login attempt is made with a non-existent username, the server returns a 401/403 response almost immediately. However, if the username exists, the server performs a bcrypt password hash comparison, causing a measurable delay. This timing discrepancy (CWE-208) can be exploited to enumerate valid usernames by measuring response times. The issue is patched in version 1.3.2-beta.

An attacker can leverage the timing difference in authentication responses to determine whether a username exists on the system. This information disclosure can facilitate targeted attacks such as credential stuffing or brute force attacks. The vulnerability does not directly impact confidentiality, integrity, or availability beyond username enumeration.

Upgrade to FileBrowser Quantum version 1.3.2-beta or later, where the timing discrepancy in the authentication endpoint has been fixed. No other mitigation is required as the patch addresses the issue directly.