CVE-2026-8794 PaperCut NG/MF: User enumeration via timing attack
Unauthenticated attackers can enumerate valid usernames by measuring response time differences during login attempts in PaperCut NG/MF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8794?
CVE-2026-8794 is a medium-severity vulnerability in PaperCut NG/MF, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
Weakness: CWE-208
Which versions are affected by CVE-2026-8794?
How do I fix CVE-2026-8794?
No fix has been published for CVE-2026-8794 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8794 being exploited?
There is no known exploitation of CVE-2026-8794 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-56w5-2p66-mx39.