Servers and applications
GHSA-34cf-fv2h-gwmq
v7/v8 XLTS: Back-office login response timing reveals whether a username exists
- Severity
- Medium 5.3
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 7.15.16, 8.18.18
- Weakness
- Timing discrepancy (CWE-208)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- Project advisories (GitHub)
Description
The back-office login takes measurably less time to respond when the username does not exist than when it does. As a result, an unauthenticated attacker can find out whether a given username has a back-office account on the site. Affects Umbraco CMS 7 and 8.
Severity: Medium
The back-office login takes measurably less time to respond when the username does not exist than when it does. Both cases return the same response, so the difference in response time is the only signal.
An unauthenticated attacker can find out whether a given username has a back-office account by comparing response times over repeated requests.
What is exposed. Whether a username has a back-office account. No passwords, content or access to accounts are exposed. Knowing which usernames exist can make password guessing or phishing against back-office users easier.
Affected software
| Software | Affected versions |
|---|---|
Umbraco CMSServers and applications · github:umbraco/umbraco-cms |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-34cf-fv2h-gwmq
- github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-34cf-fv2h-gwmq