PT-2026-56685 · Unknown · Filebrowser Quantum

CVE-2026-54685 · Published 2026-03-24 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum (affected versions not specified)

Description The /api/auth/login endpoint is susceptible to a timing side-channel attack. The Auth() function within the JSONAuth module in auth/json.go performs a database lookup for the username before validating the password. If the username is invalid, the server returns a response almost immediately. However, if the username is valid, the server executes a bcrypt password comparison, which is computationally expensive and introduces a measurable delay. This difference in response time allows an unauthenticated attacker to distinguish between valid and invalid usernames.

Recommendations As a temporary mitigation, restrict access to the /api/auth/login endpoint to minimize the risk of username enumeration.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-54685

GHSA-7789-65HX-F26W

GO-2026-4820

Affected Products

Filebrowser Quantum

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54685.json · Exploit
• https://osv.dev/vulnerability/GHSA-7789-65hx-f26w · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54685 · Security Note
• https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85 · Note
• https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta · Note
• https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w · Note
• https://github.com/gtsteffaniak/filebrowser · Note