CVE-2026-78551 - RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
Brief
CVE ID : CVE-2026-78551
Published : Aug. 24, 2026, 8:17 p. m.
- 54 minutes ago
Description : RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources.
For local authentication, the login implementation previously checked whether a submitted username existed before invoking the password hash verification function. Requests containing a nonexistent username therefore returned significantly faster than requests for valid accounts, for which the computationally expensive password verification routine was executed.
A remote attacker could measure these response-time differences to determine which usernames correspond to valid RansomLook accounts.