OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.
Catalyst::Plugin::Authentication versions before 0.10029 for Perl contain a timing attack vulnerability in the legacy password verifier. The legacy verifier uses eq comparisons for clear-text passwords, crypt hashes, and base64 digests, causing response times to vary based on matching leading bytes. This timing discrepancy allows a remote attacker to infer stored passwords or hashes. The issue was fixed in version 0.10029.
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection into a branch. The `Montgomery ladder` uses `uint256_select` with an all-zeros or all-ones mask, but affected GCC builds at `-O2` recover the original condition and emit secret-dependent `je` or `jne` jumps whose timing correlates with scalar bits. This defeats the assumption behind the 0.17.0 `jp_add_internal` infinity-branch fix. A consumer must multiply a secret private key or nonce in a context where an attacker can observe timing; repeated measurements can statistically recover scalar bits. The defect is in the compiled binary, so source review or `ctgrind` on a non-reconstructing toolchain may miss it. GCC 14.3.0, 15.1.0, and 15.2.0 reproduced the branch reconstruction, and `extconf.rb` appends `-O2`. Tested GCC versions through 12.4.0 used bitwise operations and GCC 13.3.0 used constant-time `cmov`; the pure-Ruby path is not affected by this flaw and separately makes no constant-time claim. GCC 16 and clang were untested, and point releases, targets, and flag combinations were not exhaustively bisected. `Earlier pre-0.17.0 versions had different constant-time issues rather than this introduced select idiom.` Version 0.18.0 contains the verified fix. The advisory's broad pre-0.18.0 guidance also covers earlier, different constant-time issues; whether this CVE groups those issues or only the select idiom introduced in 0.17.0 remains unresolved.
Picsou-finance version prior to 1.0.8 contains a timing discrepancy vulnerability in its login endpoint that allows an attacker to determine valid usernames by measuring response times. The login implementation throws an exception immediately for unknown usernames but performs a bcrypt password comparison for existing usernames, causing observable timing differences. This vulnerability does not expose or modify account data directly but can facilitate username enumeration, aiding credential stuffing or brute-force attacks. The issue is fixed in version 1.0.8.
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
CVE-2026-65630 is a timing side-channel vulnerability in the potatosalad jose library's pure-Erlang X25519 implementation. The vulnerability allows an attacker to recover a long-term X25519 private key by measuring decryption timing variations when processing attacker-supplied ECDH-ES (JWE) messages. This compromises the confidentiality and authenticity of data protected by the affected key. The issue affects versions from 1.10.0 up to but not including 1.11.13 and is fixed in version 1.11.13.
CVE-2026-87946 is an observable timing discrepancy vulnerability in the Drupal SAML SSO - Service Provider module that allows brute force attacks. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability has a medium severity with a CVSS score of 4.8. A fix is available in version 3.2.0.
CVE-2026-24715 is a medium severity vulnerability in QNAP Systems Inc. QuRouter involving an observable timing discrepancy (CWE-208). This flaw could allow remote attackers to obtain sensitive data. The issue affects QuRouter versions from 2.7.0 up to but not including 2.7.2.113. The vulnerability has been fixed in QuRouter version 2.7.2.113 and later.
CVE-2026-18040 is a timing side-channel vulnerability in Bouncy Castle for Java versions from 1.73 up to but not including 1.86. It involves leakage of secret-derived data during HQC encapsulation and decapsulation due to cache-timing effects in GF(2^8) arithmetic and a fixed-weight support sampler. The vulnerability allows an attacker observing cache behavior or timing to gain information about the HQC private key. The issue is fixed in version 1.86 by removing table lookups and making the sampler branch-free.
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
A timing discrepancy vulnerability exists in Traefik versions 3.6.11 through 3.7.12 in the BasicAuth middleware. This flaw allows an attacker to determine whether a username exists by observing timing differences in authentication attempts. The issue does not disclose passwords or bypass authentication and is fixed in version 3.7.13.
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.
Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
CVE-2026-87737 is a timing side-channel vulnerability in the mirage-crypto-ec package for OCaml versions before 2.4.0. The issue arises during NIST elliptic-curve scalar multiplication where the time taken for a lookup operation can vary depending on secret data. This discrepancy can potentially allow an attacker to infer sensitive cryptographic information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering.
This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.