CVE-2026-61503 affects Rejetto HFS versions 3.0.0 through 3.2.0. The vulnerability is an observable response discrepancy at the login endpoint that reveals whether a username exists. This information disclosure enables remote unauthenticated attackers to enumerate valid usernames, including the default admin account. Such enumeration can aid in password guessing and session forgery attacks. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality but no impact on integrity or availability. No official remediation or patch is currently documented.

The vulnerability allows attackers to confirm valid usernames remotely without authentication. This facilitates targeted password guessing and session forgery attacks, increasing the risk of unauthorized access. However, the impact on confidentiality is low, and there is no direct impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the login endpoint or implementing additional monitoring for suspicious login attempts. Avoid exposing the login interface to untrusted networks if possible.