CVE-2026-107269 in Gophish
Summary
by MITRE • 10/07/2026
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Gophish versions up to 0.12.1 represents a classic timing side-channel attack vector within the administrative authentication mechanism. Specifically, the flaw resides in the AdminServer.Login function, which processes user credentials submitted via POST requests to the /login endpoint. The core technical issue stems from how the application handles password verification against stored hashes using bcrypt. In many implementations, if the username provided does not exist in the database, the system may return an error or a generic failure response immediately without performing the computationally expensive hash comparison operation. However, for valid usernames that do exist, the server proceeds to execute the bcrypt hashing algorithm to compare the submitted password with the stored hash. This process introduces a measurable delay in the HTTP response time compared to requests made with invalid usernames.
This timing discrepancy allows unauthenticated attackers to perform username enumeration by analyzing the latency of login attempts. By submitting various candidate usernames and measuring the precise duration required for the server to respond, an attacker can statistically distinguish between valid and invalid accounts. Valid users will exhibit a slightly longer response time due to the execution of the bcrypt comparison logic, whereas invalid users result in faster rejection responses. This capability effectively neutralizes any security through obscurity that might have been relied upon by administrators who assumed that generic error messages would prevent account discovery. The ability to accurately identify valid usernames significantly lowers the barrier for subsequent attacks such as targeted password guessing or credential stuffing campaigns against specific administrative accounts.
From an operational impact perspective, this vulnerability facilitates reconnaissance activities that are critical precursors to unauthorized access. Once a list of valid administrator usernames is compiled through timing analysis, attackers can focus their brute-force efforts exclusively on these known targets, thereby increasing the efficiency and success rate of password attacks. This undermines the integrity of the administrative interface, potentially leading to full compromise of the Gophish instance. Such a breach could allow adversaries to manipulate phishing campaigns, exfiltrate sensitive data collected from victims, or use the compromised server as a pivot point for further network intrusion. The risk is particularly acute in environments where weak passwords are used for administrative accounts, although even strong passwords may be vulnerable if subjected to sustained automated attacks leveraging this enumeration capability.
To mitigate this vulnerability, it is essential to implement constant-time comparison algorithms for password verification regardless of whether the username exists in the database. This ensures that the processing time remains consistent for both valid and invalid usernames, thereby eliminating the timing side channel. Additionally, implementing account lockout policies or rate limiting on the login endpoint can significantly hinder automated enumeration attempts by introducing delays or blocking requests after a certain number of failed attempts. Deploying a Web Application Firewall with behavioral analysis capabilities may also help detect and block suspicious patterns of rapid login attempts from single IP addresses. Furthermore, ensuring that all administrative interfaces utilize multi-factor authentication adds an additional layer of security that is not susceptible to timing-based username enumeration attacks.
This vulnerability aligns with CWE-208, which describes the exposure of a Timing Side Channel in observable response times, and falls under MITRE ATT&CK technique T1110.001, specifically Brute Force: Password Guessing, as it enables more efficient credential stuffing by first identifying valid targets. Addressing this issue requires both immediate patching to version 0.12.2 or later where the flaw is resolved and long-term architectural changes to ensure that authentication mechanisms do not leak information through timing variations. Security teams should audit their deployment configurations for similar patterns in other web applications, as this type of vulnerability is common in systems that optimize performance by short-circuiting validation logic for non-existent entities without accounting for side-channel implications.