CVE-2026-62860

The Picsou personal finance dashboard is vulnerable to a timing discrepancy in the /api/auth/login endpoint, specifically within AuthController.login(). The application returns a BadCredentialsException immediately for unknown usernames, while valid usernames with incorrect passwords incur a high...

CVE-2026-62860 Picsou vulnerable to login timing attack

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

CVE-2026-62860: Zoeille picsou-finance: Picsou is a self-hosted personal finance dashboard

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...