CVE-2026-23849: File Browser vulnerable to Username Enumeration via Timing Attack in /api/login

Vulnerability summary

CVE-2026-23849 is a medium (CVSS 5.3) Observable Timing Discrepancy vulnerability in filebrowser. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-01-2026
   PublishedVulnerability first disclosed.
2. 20-01-2026
   Last modifiedVulnerability information updated.

Description

File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint. The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow. This difference in execution path creates a measurable timing discrepancy. Version 2.55.0 contains a patch for the issue.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.