CVE-2026-62860

The Picsou personal finance dashboard is vulnerable to a timing discrepancy in the /api/auth/login endpoint, specifically within AuthController.login(). The application returns a BadCredentialsException immediately for unknown usernames, while valid usernames with incorrect passwords incur a high...