CVE-2026-54685: gtsteffaniak filebrowser Observable Timing Discrepancy

Vulnerability summary

CVE-2026-54685 is a medium (CVSS 5.3) Observable Timing Discrepancy vulnerability in gtsteffaniak filebrowser. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.5% of scored vulnerabilities.

Timeline

1. 20-07-2026
   PublishedVulnerability first disclosed.
2. 21-07-2026
   Last modifiedVulnerability information updated.

Description

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.