CVE-2026-54685 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-54685

creationtimestamp| type| source ---|---|--- 2026-07-08 18:35:05+00:00| published-proof-of-concept| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w...