Login timing attack in ezsystems/ezpublish-kernel

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Versions 7.5.0 up to but not including 7.5.29 of ezsystems/ezpublish-kernel are affected by a login timing weakness. The existing randomized delay that hides whether an account exists did not work reliably in some situations, so an attacker who can send login attempts could tell whether a given account exists without knowing its password. Upgrade to version 7.5.29. The fix adds the security.yml setting ibexa.security.authentication.constant_auth_time, and if the log warns that the constant time was exceeded, increase that setting.

Written 3 Nov 2026.