CVE-2026-88834

A flaw in BusyBox's httpd web server allows for a user existence oracle when configured with system password authentication. In certain build configurations, an attacker can distinguish between existing and non-existing usernames by observing authentication failure behaviors. The impact is limite...