CVE-2026-41418

4ga Boards prior to 3.3.5 is vulnerable to user enumeration via a timing side-channel on POST /api/access-tokens. Valid username/email with wrong password yields ~74 ms bcrypt.compareSync(), vs ~17 ms for invalid username/email, creating a ~4.4× timing difference. Root cause: timing variance in l...