What’s Vulnerable › Vulnerabilities
CVE-2026-41418: 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-24 · updated 2026-10-26
- Weakness: CWE-208
Description
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.
Affected products
- RARgames 4gaBoards: before 3.3.5
References
Get alerted when CVE-2026-41418 or the next vulnerability affects your stack