CVE-2026-23849: 
NixOS vulnerability analysis and mitigation

CVE-2026-23849 is a username enumeration vulnerability via timing attack in File Browser, an open-source web-based file management interface. The flaw exists in the JSONAuth.Auth function, where a logic short-circuit causes measurably different response times depending on whether a submitted username exists in the database. It affects all versions of github.com/filebrowser/filebrowser/v2 prior to 2.55.0 (and all v1 releases up to 1.11.0, which have no patch). The advisory was published on January 18, 2026, with NVD publication on January 19, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-208 (Observable Timing Discrepancy) and CWE-203 (Observable Discrepancy). In auth/json.go, the authentication logic uses a short-circuit || evaluation: if the username is not found in the database, the function returns immediately (~1ms); if the username exists, the code proceeds to bcrypt password verification via users.CheckPwd, a deliberately slow operation (~50ms+). This asymmetry creates a statistically significant and measurable timing difference that an unauthenticated remote attacker can exploit over the network with no privileges or user interaction required. A public proof-of-concept Python script is included in the security advisory, which calibrates a baseline using random usernames and then identifies valid accounts by comparing response times against a computed threshold (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an unauthenticated remote attacker to enumerate valid usernames registered in the File Browser instance. While there is no direct integrity or availability impact, the disclosed username list significantly reduces the effort required for subsequent targeted brute-force or credential stuffing attacks against known-valid accounts such as admin, root, or employee names. This weakens the overall authentication security posture and can serve as a reconnaissance step enabling account compromise and unauthorized access to managed files (Github Advisory).

A public proof-of-concept exploit script (Python) is included directly in the GitHub Security Advisory, making this vulnerability trivially exploitable by any attacker with network access to the /api/login endpoint. No authentication, privileges, or user interaction are required. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.09–0.24% (47th percentile), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible File Browser instances running versions prior to 2.55.0 using tools like Shodan, Censys, or by directly probing the /api/login endpoint.
2. Calibrate baseline: Use the PoC script (or equivalent) to send POST requests to /api/login with randomly generated, non-existent usernames (e.g., 20 samples) and record response times to establish a mean and standard deviation baseline (~1ms for invalid users).
3. Compute threshold: Calculate a detection threshold as mean + (5 × stdev) + 0.005 seconds to account for network jitter and distinguish invalid from valid user response times.
4. Enumerate usernames: Iterate through a wordlist of candidate usernames (e.g., admin, root, employee names), sending POST requests to /api/login with a dummy password ({"username": "<candidate>", "password": "dummy_pass_123!"}). Responses exceeding the threshold (~50ms+) indicate a valid username.
5. Leverage results: Use the confirmed valid usernames to conduct targeted brute-force or credential stuffing attacks against the File Browser login endpoint to achieve account compromise (Github Advisory, GitHub Security Advisory).

• Network: High volume of POST requests to /api/login from a single IP or small set of IPs, especially with varying usernames and a constant dummy password; requests arriving in rapid succession consistent with automated scripting.
• Logs: Web server or application access logs showing repeated 401/403 responses to /api/login with many different usernames in a short time window; pattern of requests with response times clustering around ~1ms (invalid) and ~50ms+ (valid) may be visible in detailed timing logs.
• Behavioral: Sudden spike in authentication failures against the /api/login endpoint not associated with a known user activity period; enumeration attempts may precede a targeted brute-force campaign against a specific username (Github Advisory).

Upgrade File Browser to version 2.55.0 or later, which resolves the timing discrepancy by introducing a dummy bcrypt hash (dummyHash) that is always evaluated regardless of whether the username exists, ensuring constant-time authentication behavior (GitHub Commit). For systems that cannot be patched immediately, implement rate limiting on the /api/login endpoint to increase the cost and time required for enumeration attacks, and monitor authentication logs for suspicious patterns of repeated login attempts with varying usernames. Note that v1 releases (<= 1.11.0) have no available patch and should be migrated to v2.55.0+ (Github Advisory).

The vulnerability was discovered and reported by security researcher Felix Sanchez (GUCHIHACKER) and reviewed for remediation by File Browser maintainer hacdias. Red Hat has tracked the CVE in their security advisory database. No significant broader media coverage or notable community debate has been identified beyond the standard advisory publication (GitHub Security Advisory, Red Hat Advisory).