CVE-2026-61503 describes an information disclosure vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The login endpoint returns observably different responses based on the existence of the submitted username. This behavior enables remote unauthenticated attackers to enumerate valid account names, including the default administrator account. Such username enumeration can aid in subsequent password guessing and session forgery attacks. The vulnerability is rated medium severity with a CVSS 4.0 base score of 6.9. No vendor advisory or patch information is provided, and the remediation level is unknown.

The vulnerability allows attackers to confirm valid usernames remotely without authentication. This information disclosure can facilitate targeted password guessing and session forgery attacks, potentially leading to unauthorized access. However, there is no indication of direct code execution or data corruption from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the login endpoint or implementing additional monitoring to detect username enumeration attempts. Avoid relying solely on this login endpoint for authentication security.