Vulnerability Description
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-8794?
CVE-2026-8794 is a documented vulnerability. PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring...
How severe is CVE-2026-8794?
CVSS scoring is not yet available for CVE-2026-8794. Check NVD for updates.
Is there a patch for CVE-2026-8794?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.