CVE-2026-78551 in RansomLook
Summary
by MITRE • 08/24/2026
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources.
For local authentication, the login implementation previously checked whether a submitted username existed before invoking the password hash verification function. Requests containing a nonexistent username therefore returned significantly faster than requests for valid accounts, for which the computationally expensive password verification routine was executed. A remote attacker could measure these response-time differences to determine which usernames correspond to valid RansomLook accounts.
In addition, the /login endpoint did not restrict the number or frequency of failed authentication attempts. An attacker could consequently perform password brute-force, dictionary, password-spraying, or credential-stuffing attacks against known accounts without server-side throttling. For valid usernames, each authentication attempt also invokes the password key-derivation function, which consumes a significant amount of CPU time. A sufficiently high rate of login attempts could therefore occupy the application's synchronous Gunicorn workers and cause a denial of service affecting the entire application.
The issue has been addressed by always performing password verification using a randomly generated dummy password hash when the supplied username does not exist, eliminating the username-dependent timing discrepancy. Failed authentication attempts are additionally rate-limited per client IP address using Valkey/Redis, with five failed attempts within five minutes resulting in a one-hour block. The reverse-proxy configuration was also updated so that the application derives the client address from a trusted X-Forwarded-For value that cannot be overridden by a client-supplied header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in RansomLook represents a critical failure in authentication security controls, encompassing both information disclosure and resource exhaustion risks. The core technical flaw lies in the implementation of the local authentication endpoint, which exhibited timing side-channel vulnerabilities that allowed for user enumeration. Specifically, the application logic was structured to first verify if a submitted username existed within the database before proceeding to validate the corresponding password hash. This sequential processing created a measurable disparity in response times; requests associated with non-existent usernames returned significantly faster than those targeting valid accounts because they bypassed the computationally expensive password verification routine. An unauthenticated remote attacker could exploit this discrepancy by sending numerous login attempts and measuring latency differences, thereby accurately determining which usernames correspond to active RansomLook accounts without needing prior knowledge of specific credentials.
Beyond user enumeration, the authentication mechanism lacked essential rate-limiting protections against brute-force attacks. The endpoint did not restrict the number or frequency of failed authentication attempts from a single source. This omission enabled attackers to conduct unrestricted password-guessing campaigns, including dictionary attacks, credential stuffing, and password spraying, without encountering server-side throttling mechanisms. Furthermore, because each login attempt triggers the application's password key-derivation function regardless of success or failure, this lack of restriction carries severe operational implications for system availability. A sufficiently high volume of authentication requests can consume significant CPU resources as workers process these cryptographic operations. Since RansomLook utilizes synchronous Gunicorn workers, a sustained attack could exhaust all available worker threads, leading to a denial of service that renders the entire application inaccessible to legitimate users.
The remediation strategy addresses both the timing side-channel and the resource exhaustion vectors through architectural and configuration changes. To eliminate the user enumeration risk, the developers modified the authentication logic to always perform password verification using a randomly generated dummy hash when the supplied username does not exist. This ensures that response times remain consistent regardless of whether the account is valid or invalid, effectively neutralizing timing-based attacks. Concurrently, rate limiting was implemented at the application level using Valkey and Redis infrastructure. The new policy restricts failed authentication attempts to five per client IP address within a rolling five-minute window; exceeding this threshold results in a one-hour block for that specific source. This mechanism directly mitigates brute-force capabilities while also preventing the CPU exhaustion associated with high-frequency login requests.
Additionally, the fix includes critical updates to the reverse-proxy configuration to ensure accurate client identification for rate-limiting purposes. Previously, reliance on standard headers may have allowed clients to spoof their IP addresses using untrusted X-Forwarded-For values. The updated configuration now derives the client address exclusively from a trusted X-Forwarded-For value that cannot be overridden by user-supplied input. This ensures that rate limits are correctly applied to the actual source of the request rather than being bypassed through header manipulation. From a classification perspective, these vulnerabilities align with CWE-208 for Observable Timing Discrepancy and CWE-307 for Improper Restriction of Excessive Authentication Attempts. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates the T1110 Brute Force technique and potentially aids in reconnaissance activities by allowing attackers to map valid user accounts before launching targeted credential attacks.