CVE-2026-54685: FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileBrowser Quantumto a version that resolves this vulnerability.Fixed in 1.3.2-beta
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54685?
CVE-2026-54685 has a medium severity rating of 5.3.
How do I fix CVE-2026-54685?
To fix CVE-2026-54685, upgrade to FileBrowser Quantum version 1.3.2-beta or later that addresses the timing side-channel vulnerability.
What is the risk of CVE-2026-54685?
CVE-2026-54685 poses a risk of username enumeration through predictable authentication timing responses.
What products are affected by CVE-2026-54685?
CVE-2026-54685 affects FileBrowser Quantum prior to version 1.3.2-beta.
What type of vulnerability is CVE-2026-54685?
CVE-2026-54685 is an authentication timing side-channel vulnerability allowing for username enumeration.