CyberRota Analysis
AI-GeneratedThe authentication endpoint of FileBrowser Quantum prior to version 1.3.2-beta is vulnerable to timing attacks due to inconsistent response times when handling login requests for valid versus invalid usernames. This flaw can potentially allow an attacker to enumerate valid usernames by measuring response delays, leading to unauthorized access. Organizations using affected versions should prioritize upgrading to version 1.3.2-beta to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.