# CWE-208.

Every Advisory and CVE whose sources give the weakness CWE-208, newest first.

## Records, newest first

- [OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading](https://agentprime.io/advisories/CVE-2026-103021.md)
  `CVE-2026-103021` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, CWE-208
- [HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay](https://agentprime.io/advisories/CVE-2026-85286.md)
  `CVE-2026-85286` · CVE record: sysadminsmedia homebox · CVSS 3.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-204, CWE-208
- [Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier](https://agentprime.io/advisories/CVE-2026-74846.md)
  `CVE-2026-74846` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-208
- [secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication](https://agentprime.io/advisories/CVE-2026-63410.md)
  `CVE-2026-63410` · CVE record: sgbett secp256k1-native · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-208, CWE-1255
- [Picsou vulnerable to login timing attack](https://agentprime.io/advisories/CVE-2026-62860.md)
  `CVE-2026-62860` · CVE record: Zoeille picsou-finance · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-208
- [Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets](https://agentprime.io/advisories/CVE-2026-93434.md)
  `CVE-2026-93434` · CVE record: WatchGuard Fireware OS · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-20, CWE-208
- [Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose](https://agentprime.io/advisories/GHSA-xvr2-gggj-h2pp.md)
  `GHSA-xvr2-gggj-h2pp`, `CVE-2026-65630`, `EEF-CVE-2026-65630` · Hex `jose`: affected `>=1.10.0, <1.11.13`, fixed in `1.11.13` · CVSS 5.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-208
- [SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144](https://agentprime.io/advisories/CVE-2026-87946.md)
  `CVE-2026-87946` · CVE record: Drupal SAML SSO - Service Provider · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-208
- [Lack of Reproducible Vulnerability Evidence in QNAP Report](https://agentprime.io/advisories/CVE-2026-24715.md)
  `CVE-2026-24715` · CVE record: QNAP Systems Inc. QuRouter · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-208
- [Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check](https://agentprime.io/advisories/CVE-2026-109379.md)
  `CVE-2026-109379` · CVE record: cockpit-hq cockpit · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-208
- [Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison](https://agentprime.io/advisories/CVE-2026-83535.md)
  `CVE-2026-83535` · CVE record: Red Hat Red Hat OpenStack Platform 18.0 · CVSS 7.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-208
- [Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy](https://agentprime.io/advisories/CVE-2026-107269.md)
  `CVE-2026-107269` · CVE record: gophish gophish · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-208
- [HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler](https://agentprime.io/advisories/CVE-2026-18040.md)
  `CVE-2026-18040` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 5.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-208
- [NTRU leaks private key information by reducing secret values with a non-constant-time integer division](https://agentprime.io/advisories/CVE-2026-18036.md)
  `CVE-2026-18036` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-208
- [Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)](https://agentprime.io/advisories/GHSA-xpv3-w29h-x7cv.md)
  `GHSA-xpv3-w29h-x7cv`, `CVE-2026-49265`, `PYSEC-2026-4114` · PyPI `oauthlib`: affected `>=3.0.0, <4.0.0`, fixed in `4.0.0` · CVSS 6.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208
- [Timing Side-Channel in SM2 Signature Generation](https://agentprime.io/advisories/CVE-2026-77696.md)
  `CVE-2026-77696` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208
- [Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V](https://agentprime.io/advisories/CVE-2026-54875.md)
  `CVE-2026-54875` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208
- [Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves](https://agentprime.io/advisories/CVE-2026-54872.md)
  `CVE-2026-54872` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-208
- [GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery](https://agentprime.io/advisories/CVE-2026-77987.md)
  `CVE-2026-77987` · CVE record: GitHub Enterprise Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-208
- [Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle](https://agentprime.io/advisories/GHSA-8fcf-v89g-xpg6.md)
  `GHSA-8fcf-v89g-xpg6`, `CVE-2026-88010`, `GO-2026-6558` · Go `github.com/traefik/traefik` and 1 more: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function](https://agentprime.io/advisories/GHSA-c759-cx9p-mrwq.md)
  `GHSA-c759-cx9p-mrwq`, `CVE-2026-85725`, `PYSEC-2026-4061` · PyPI `lightrag-hku`: affected `<1.5.5`, fixed in `1.5.5` · CVSS 5.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [Tinyauth: User enumeration attack by timing oracle](https://agentprime.io/advisories/GHSA-456h-ww26-f758.md)
  `GHSA-456h-ww26-f758`, `CVE-2026-77582`, `GO-2026-6555` · Go `github.com/tinyauthapp/tinyauth`: affected `<1.0.1-0.20260714134959-c22925c2fba9`, fixed in `1.0.1-0.20260714134959-c22925c2fba9` · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack](https://agentprime.io/advisories/GHSA-34fc-gh42-pj53.md)
  `GHSA-34fc-gh42-pj53`, `BIT-openbao-2026-63132`, `CVE-2026-63132`, `GO-2026-6553` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260713141742-763625a20721 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260713141742-763625a20721` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)](https://agentprime.io/advisories/GHSA-29hq-23m2-2j47.md)
  `GHSA-29hq-23m2-2j47`, `CVE-2026-58272` · npm `@sync-in/server`: affected `<2.4.1`, fixed in `2.4.1` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy](https://agentprime.io/advisories/CVE-2026-95270.md)
  `CVE-2026-95270` · CVE record: dgtlmoon changedetection.io · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-208
- [Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection](https://agentprime.io/advisories/GHSA-38p6-h87p-r4cg.md)
  `GHSA-38p6-h87p-r4cg`, `CVE-2026-72701`, `PKSA-xzd7-91fp-yh97` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-208
- [An issue was discovered in Nagios XI before 5.9.3.](https://agentprime.io/advisories/CVE-2023-24035.md)
  `CVE-2023-24035` · CVE record: Nagios Nagios XI · CVSS 3.5 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-208
- [An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml.](https://agentprime.io/advisories/CVE-2026-87737.md)
  `CVE-2026-87737` · CVE record: OCaml mirage-crypto-ec · CVSS 5.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-208
- [phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery](https://agentprime.io/advisories/GHSA-q97c-8qh3-fpc6.md)
  `GHSA-q97c-8qh3-fpc6`, `CVE-2026-84308`, `PKSA-12sz-bcny-pk4m` · Packagist `phpseclib/phpseclib`: affected `<3.0.57 || >=4.0.0, <4.0.1`, fixed in `3.0.57`, `4.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-208, CWE-385
- [Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module](https://agentprime.io/advisories/CVE-2026-16037.md)
  `CVE-2026-16037` · CVE record: PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-208
- [Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106](https://agentprime.io/advisories/CVE-2026-81159.md)
  `CVE-2026-81159` · CVE record: Drupal Commerce CyberSource · CVSS 3.7 Low · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-208
- [Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing](https://agentprime.io/advisories/CVE-2026-82449.md)
  `CVE-2026-82449` · CVE record: cockpit-hq cockpit · CVSS 6.9 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-208
- [free5GC AUSF uses non-constant-time authentication comparisons and logs XRES\* in 5G-AKA](https://agentprime.io/advisories/GHSA-fp46-6vfw-gc9c.md)
  `GHSA-fp46-6vfw-gc9c`, `CVE-2026-55785`, `GO-2026-6328` · Go `github.com/free5gc/ausf`: affected `<1.4.5`, fixed in `1.4.5` · CVSS 3.7 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Information disclosure, CWE-208, CWE-385
- [Phalcon: Non-constant-time HMAC verification in \`Encryption\Crypt::decrypt\` (timing side-channel)](https://agentprime.io/advisories/GHSA-8jqh-95g6-7jpj.md)
  `GHSA-8jqh-95g6-7jpj`, `CVE-2026-54736`, `PKSA-65xj-m5g6-56k1` · Packagist `phalcon/cphalcon`: affected `<5.14.1`, fixed in `5.14.1` · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, CWE-208
- [Dimension Blind SSRF via Database Test Connection Feature](https://agentprime.io/advisories/CVE-2026-78500.md)
  `CVE-2026-78500` · CVE record: WatchGuard Dimension · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-208
- [Timing Attack via Non-Constant-Time Comparison of Sensitive Values](https://agentprime.io/advisories/CVE-2026-59276.md)
  `CVE-2026-59276` · CVE record: Spring Spring Security · CVSS 5.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-208
- [Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090](https://agentprime.io/advisories/CVE-2026-18259.md)
  `CVE-2026-18259` · CVE record: Drupal Token Content Access · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-208
- [Duplicate Advisory: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection](https://agentprime.io/advisories/GHSA-px9v-979x-qmh9.md)
  `GHSA-px9v-979x-qmh9` · Packagist `getgrav/grav`: affected `*`, no fixed version yet · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-208
- [Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison](https://agentprime.io/advisories/CVE-2026-72700.md)
  `CVE-2026-72700` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-208
- [WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication](https://agentprime.io/advisories/CVE-2026-53525.md)
  `CVE-2026-53525` · CVE record: weechat weechat · CVSS 7.4 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-208
- [Wazuh: Username Enumeration via Timing Side-Channel](https://agentprime.io/advisories/CVE-2026-44255.md)
  `CVE-2026-44255` · CVE record: wazuh wazuh · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-208
- [Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify](https://agentprime.io/advisories/CVE-2026-75589.md)
  `CVE-2026-75589` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-208
- [Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling](https://agentprime.io/advisories/GHSA-92hr-gmr6-h8cp.md)
  `GHSA-92hr-gmr6-h8cp` · npm `ep_etherpad-lite`: affected `<3.3.0`, fixed in `3.3.0` · No CVSS score · Not analysed yet · Published 17 Aug 2026 · Tags: Path traversal, Information disclosure, Weak cryptography or TLS, CWE-208
- [Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto](https://agentprime.io/advisories/CVE-2026-16458.md)
  `CVE-2026-16458` · CVE record: Oberon microsystems AG ocrypto · CVSS 5.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Weak cryptography or TLS, CWE-208
- [Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto](https://agentprime.io/advisories/CVE-2026-16459.md)
  `CVE-2026-16459` · CVE record: Oberon microsystems AG Oberon PSA Crypto · CVSS 5.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Weak cryptography or TLS, CWE-208
- [Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks,…](https://agentprime.io/advisories/CVE-2026-43606.md)
  `CVE-2026-43606` · CVE record: AMD Vitis™ Libraries - Security Module and 1 more · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-208
- [CVE-2026-6727](https://agentprime.io/advisories/CVE-2026-6727.md)
  `CVE-2026-6727` · CVE record: Trusted Computing Group TPM2.0 · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-208
- [Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack](https://agentprime.io/advisories/CVE-2025-49506.md)
  `CVE-2025-49506` · CVE record: Apache Software Foundation Apache Portable Runtime Utility · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-208
- [Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout](https://agentprime.io/advisories/CVE-2026-16731.md)
  `CVE-2026-16731` · CVE record: OMICRON electronics GmbH OMICRON StationScout · CVSS 8.3 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-208
- [Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard](https://agentprime.io/advisories/CVE-2026-16315.md)
  `CVE-2026-16315` · CVE record: OMICRON electronics GmbH OMICRON StationGuard · CVSS 8.1 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-208
- [Jenkins Project Jenkins Webhook Secret Credentials Provider…: Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not…](https://agentprime.io/advisories/CVE-2026-70437.md)
  `CVE-2026-70437` · CVE record: Jenkins Project Jenkins Webhook Secret Credentials Provider Plugin · CVSS 3.7 Low · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-208
- [cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing](https://agentprime.io/advisories/GHSA-g6cj-pr64-35w5.md)
  `GHSA-g6cj-pr64-35w5`, `CVE-2026-69247`, `PYSEC-2026-3552` · PyPI `cryptography`: affected `>=44.0.0, <50.0.0`, fixed in `50.0.0` · CVSS 8.2 High · Not analysed yet · Published 3 Aug 2026 · Tags: Information disclosure, CWE-208
- [PaperCut NG/MF: User enumeration via timing attack](https://agentprime.io/advisories/CVE-2026-8794.md)
  `CVE-2026-8794` · CVE record: PaperCut PaperCut NG/MF · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-208
- [ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)](https://agentprime.io/advisories/CVE-2024-14041.md)
  `CVE-2024-14041` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-208
- [Open WebUI: Account enumeration via observable login timing discrepancy](https://agentprime.io/advisories/GHSA-7rw5-9f7q-xj36.md)
  `GHSA-7rw5-9f7q-xj36`, `CVE-2026-59218`, `PYSEC-2026-3594` · PyPI `open-webui`: affected `<0.10.0`, fixed in `0.10.0` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-208
- [RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13183.md)
  `CVE-2026-13183` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-208
- [Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification](https://agentprime.io/advisories/CVE-2026-15432.md)
  `CVE-2026-15432` · CVE record: Google Tink-Java and 1 more · CVSS 8.2 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-208
- [Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks](https://agentprime.io/advisories/CVE-2026-6656.md)
  `CVE-2026-6656` · CVE record: DRSTEVE Crypt::Password · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-208
- [Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison](https://agentprime.io/advisories/CVE-2026-9537.md)
  `CVE-2026-9537` · CVE record: JBERGER Mojo::JWT · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-208
- [HCL BigFix Platform is affected by a user enumeration vulnerability](https://agentprime.io/advisories/CVE-2026-21840.md)
  `CVE-2026-21840` · CVE record: HCLSoftware HCL BigFix Platform · CVSS 3.1 Low · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-208

Older: <https://agentprime.io/advisories/tag/cwe-208.md?cursor=WyIyMDI2LTA3LTE0VDIxOjM2OjUyLjc3NjAwMFoiLCJDVkUtMjAyNi0yMTg0MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-208>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-208/>. Everything for agents: <https://agentprime.io/llms.txt>.