{"id":"CVE-2026-62860","aliases":[],"cve":{"records":[{"id":"CVE-2026-62860","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T21:10:50.032Z","published":"2026-10-30T20:40:46.993Z","modified":"2026-11-06T18:18:00.135Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:40:46.993Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T18:18:00.135Z"}],"references":[{"url":"https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-208","description":"CWE-208: Observable Timing Discrepancy","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T18:15:52.514765Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Picsou vulnerable to login timing attack","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.","score":5.3,"severity":"medium","published":"2026-10-30T20:40:46.993Z","modified":"2026-11-06T18:18:00.135Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Zoeille","name":"picsou-finance","platforms":[],"versions":[{"version":"< 1.0.8","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-62860"}],"remediation":[],"references":["https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6","https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59","https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8"],"sources":[{"name":"CVE","id":"CVE-2026-62860","modified":"2026-11-06T18:18:00.135Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62860"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-06T19:14:21.006Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:25:31.770Z","attemptedAt":"2026-10-30T21:25:31.770Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T21:25:31.770Z","attemptedAt":"2026-10-30T21:25:31.770Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T21:25:32.321Z","attemptedAt":"2026-10-30T21:25:32.321Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T21:25:31.764Z","attemptedAt":"2026-10-30T21:25:31.764Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-62860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62860","modified":"2026-10-30T21:17:14.400","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T21:25:31.770Z"}],"aiSummary":{"text":"Picsou, a self-hosted personal finance dashboard, has a login timing attack vulnerability in versions before 1.0.8, where the login endpoint reveals whether a username exists through a timing discrepancy. An attacker with network access can exploit this to disclose valid usernames without credentials. This can assist credential stuffing or brute-force attacks.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:01:03.145Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62860"}]}}