CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication
Attackers can enumerate valid usernames via timing differences in Basic Authentication, facilitating targeted brute-force attacks against Static Web Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27480?
CVE-2026-27480 is a medium-severity vulnerability in static-web-server, published on 21 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames, enabling targeted brute-force or credential-stuffing attacks. SWS checks whether a username exists before verifying the password, causing valid usernames to follow a slower code path (e.g., bcrypt hashing) while invalid usernames receive an immediate 401 response. This timing discrepancy allows attackers to enumerate valid accounts by measuring response-time differences. This issue has been fixed in version 2.41.0.
Weakness: CWE-204
Which versions are affected by CVE-2026-27480?
2 open source packages ship an affected version, including static-web-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
static-web-server crates.io | From 2.1.0 | 2.41.0 |
static-web-server crates.io | From 2.1.0 | 2.41.0 |
Products include Static-Web-Server Static Web Server.
How do I fix CVE-2026-27480?
Upgrade static-web-server to 2.41.0 or later.
Is CVE-2026-27480 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27480 exists.
Other vulnerabilities in static-web-server
Sources
Also known as GHSA-qhp6-635j-x7r2.