CVE-2026-54685 Details

A username enumeration vulnerability has been identified in FileBrowser Quantum versions prior to 1.3.2-beta. The issue arises in the '/api/auth/login' authentication endpoint, which does not process requests in constant time. When an invalid username is provided, the server quickly returns a '401' or '403' response. In contrast, a valid username triggers a bcrypt password comparison, introducing a noticeable delay in the response. This timing difference allows an attacker to distinguish between valid and invalid usernames by measuring response times.

Users are advised to update to FileBrowser Quantum version 1.3.2-beta, which addresses this vulnerability by ensuring that authentication processes execute in constant time, regardless of username validity.