hyperkitty before 1.3.5 is vulnerable to timing attack. The vulnerability exists because of lack of using a constant time check when evaluating the value of the secret archiver key...
7.1CVSS6AI score
SaveExploits0References2
Mend•added 2026/05/14 4:41 p.m.•3 views
CVE-2021-35058
A security issue has been found in HyperKitty before version 1.3.5. The secret archiver key is passed as a GET query parameter and can therefore be leaked into the HTTP server logs...
