CVE-2026-61503: Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
Published Jul 13, 2026
·Updated
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
Affected Software
2 affected components
Rejetto HFS>=3.0.0<=3.2.0
HFS<3.2.1
Event History
Jul 13, 2026
CVE Published
via MITRE·05:23 PM
Data Sourced
via MITRE·05:23 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-61503?
The severity of CVE-2026-61503 is medium with a score of 5.3.
2
How do I fix CVE-2026-61503?
To fix CVE-2026-61503, upgrade to Rejetto HFS version 3.2.1 or later.
3
What risk does CVE-2026-61503 pose to my system?
CVE-2026-61503 allows remote unauthenticated attackers to enumerate usernames, which could lead to password-guessing attacks.
4
Which versions of Rejetto HFS are affected by CVE-2026-61503?
Rejetto HFS versions 3.0.0 through 3.2.0 are affected by CVE-2026-61503.
5
Can CVE-2026-61503 be exploited without authentication?
Yes, CVE-2026-61503 can be exploited by remote unauthenticated attackers.