CVE-2026-107269 — Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login res…
Published: 2026-10-07 · CVSS: 6.3 · CVSS 4.0
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7