Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid… (CVE-2026-107269)

Gophish through version 0.12.1 contains a timing discrepancy vulnerability in the AdminServer.Login endpoint. Unauthenticated attackers can exploit this by submitting candidate usernames to the POST /login endpoint and measuring response time differences caused by bcrypt password hash comparisons. These timing differences allow attackers to enumerate valid usernames, which can facilitate targeted password guessing or credential stuffing attacks. The vulnerability is identified as CWE-208 (Information Exposure Through Timing Discrepancy) and has a CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no information about available patches or fixes, and no known exploits in the wild have been reported.

The vulnerability allows attackers to confirm valid usernames on the Gophish platform by exploiting timing differences in login responses. This information disclosure can reduce the attacker's effort in subsequent password guessing or credential stuffing attacks. The impact is limited to information disclosure (low confidentiality impact) and does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider monitoring login endpoints for unusual access patterns and limit login attempts to reduce the risk of credential stuffing. Avoid relying solely on timing-based responses for authentication feedback.