CVE-2026-8794 — PaperCut NG/MF: User enumeration via timing attack

CVE-2026-8794

PaperCut NG/MF: User enumeration via timing attack PUBLISHED

Description (CNA)

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

Affected (CNA)

Vendor / product	Versions
PaperCut / PaperCut NG/MF	affected 0 before 26.0.3

CWE

CWE-208

References

https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.