CVE-2026-8794 — PaperCut NG/MF: User enumeration via timing attack
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username e…
Published: 2026-08-03 · CVSS: 6.9 · CVSS 4.0
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7