CVE-2026-107269: Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can reach the Gophish AdminServer login endpoint can attempt username enumeration. Exploitation does not require credentials or user interaction.
What does an attacker need to do to identify usernames?
The attacker submits candidate usernames to POST /login and measures response times. Existing accounts trigger bcrypt comparison delays, creating a timing difference from invalid usernames.
What is the practical impact of successful enumeration?
The issue exposes valid Gophish usernames, which can help an attacker narrow targets for password guessing or credential-stuffing attempts. The provided data does not indicate direct password disclosure or account compromise from this issue alone.
Which versions are affected?
Gophish through version 0.12.1 is identified as affected.