Description
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
gophish gophish
Default version status: unaffected
0 to ≤ 0.12.1affected
pkg:github/gophish/gophishReferences
- https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html ↗
- https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/route.go#L375-L390 ↗
- https://github.com/gophish/gophish ↗
- https://www.vulncheck.com/advisories/gophish-through-0.12.1-username-enumeration-via-post-login-timing-discrepancy ↗