CyberRota Analysis
AI-GeneratedGophish versions up to 0.12.1 are vulnerable due to a timing discrepancy in the AdminServer.Login function, which allows unauthenticated attackers to enumerate valid usernames by analyzing login response times. This vulnerability can lead to targeted password guessing or credential stuffing attacks, as attackers can identify existing accounts based on bcrypt comparison delays. Organizations using Gophish should prioritize addressing this issue to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.