CVE-2026-61503 Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
Remote attackers can enumerate valid usernames by observing login response differences, facilitating further attacks like password guessing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61503?
CVE-2026-61503 is a medium-severity vulnerability in rejetto hfs, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
Weakness: CWE-204
Which versions are affected by CVE-2026-61503?
How do I fix CVE-2026-61503?
No fix has been published for CVE-2026-61503 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61503 being exploited?
There is no known exploitation of CVE-2026-61503 in the wild and no public exploit code.
Sources
Also known as GHSA-pv44-gxjv-57j6.