GHSA-7789-65hx-f26w: FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

March 24, 2026 (updated July 8, 2026)

The /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time.

References

github.com/advisories/GHSA-7789-65hx-f26w
github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85
github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta
github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w
nvd.nist.gov/vuln/detail/CVE-2026-54685

Code Behaviors & Features

Detect and mitigate GHSA-7789-65hx-f26w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →