Threats tagged 'ghsa-56w5-2p66-mx39'

CVE-2026-8794 is a timing discrepancy vulnerability in the authentication component of PaperCut NG/MF. An unauthenticated remote attacker can exploit this issue to enumerate valid usernames by measuring response times during login attempts. The vulnerability arises because the system only performs a password hash comparison when a valid account is supplied, creating a timing oracle. This flaw can reveal account existence without authentication.