CVE-2026-88834: Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
Other sources
A vulnerability was found in the BusyBox httpd Basic Authentication handler (networking/httpd.c) when configured to authenticate against system passwords. A missing else clause after a failed getspnamr() call creates an observable behavioral difference between authentication failures for existing and non-existing system users. Existing user with wrong password: connection reset. Non-existing user: clean HTTP 401.
— Red Hat
Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use BusyBox httpd with system password authentication and either non-default compile options that disable shadow password support or uncommon password file states. Default BusyBox builds with shadow password support are not affected.
What can an unauthenticated attacker learn?
An attacker can enumerate system usernames by comparing authentication failures. A wrong password for an existing user resets the connection, while a nonexistent user receives a clean HTTP 401 response.
Does exploitation require valid credentials or user interaction?
No valid credentials or user interaction are required. The attacker must be able to reach the BusyBox httpd service and submit Basic Authentication attempts, and exploitation depends on observing the differing failure behavior.