CVE-2026-8794 describes a timing side-channel vulnerability (CWE-208) in PaperCut NG/MF's authentication component. An attacker can remotely perform username enumeration by observing differences in response times during login attempts. The system conditionally executes password hash comparisons only for valid usernames, enabling an attacker to distinguish valid accounts from invalid ones based on timing measurements. This vulnerability does not require authentication and has a medium severity rating with a CVSS 4.0 base score of 6.9. No official remediation or patch information is currently provided.

An unauthenticated remote attacker can enumerate valid usernames on the PaperCut NG/MF system by exploiting timing discrepancies during login attempts. This information disclosure can aid further targeted attacks such as password guessing or social engineering. There is no indication of direct compromise or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional protections such as uniform response timing or account lockout policies to reduce the risk of username enumeration.