CVE-2026-41418 — 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint

Description (CNA)

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

Affected (CNA)

Vendor / product	Versions
RARgames / 4gaBoards	affected < 3.3.5

CWE

CWE-208

References

https://github.com/RARgames/4gaBoards/security/advisories/GHSA-8mj9-p99h-jhxp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.