CVE-2026-8794
PaperCut NG/MF: User enumeration via timing attack
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 3, 2026
- Updated
- Aug 3, 2026
- Reserved
- May 17, 2026
Description
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N | PaperCut |
Weaknesses
- CWE-208 Observable timing discrepancy
Affected Products
| Product | Versions |
|---|---|
PaperCut NG/MFPaperCut |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.