CVE-2026-107269 gophish CVE debrief

Who should care

Defenders responsible for Gophish instances, particularly those exposed to untrusted networks, should assess exposure and prioritize mitigation or verification of the timing discrepancy vulnerability.

Why it matters

CVE-2026-107269 is a medium-severity vulnerability in Gophish that allows unauthenticated attackers to enumerate valid usernames via a timing discrepancy in the login function. Defenders should prioritize verifying exposure and assessing mitigation feasibility to prevent potential targeted attacks.

• Enumeration of valid usernames can facilitate targeted password guessing or credential stuffing attacks
• Successful exploitation can lead to unauthorized access or further attacks on the Gophish instance
• Defenders should verify exposure and assess mitigation feasibility to prevent potential attacks
• Remediation priority is moderate due to the medium CVSS score and potential for targeted attacks

Technical summary

The vulnerability is caused by a timing discrepancy in the AdminServer.Login function, which allows unauthenticated attackers to enumerate valid usernames by measuring login response times. This can be done by submitting candidate usernames to POST /login and detecting bcrypt comparison delays for existing accounts. The vulnerability affects Gophish through 0.12.1 and has a medium severity. Defenders should prioritize verifying exposure of Gophish instances, particularly those exposed to untrusted networks, and assess the feasibility of mitigating the timing discrepancy vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Gophish instances, particularly those exposed to untrusted networks, and assess the feasibility of mitigating the timing discrepancy vulnerability.

Recommended defensive actions

• Verify exposure of Gophish instances, particularly those exposed to untrusted networks
• Assess the feasibility of mitigating the timing discrepancy vulnerability
• Implement monitoring to detect potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the timing discrepancy vulnerability in Gophish through 0.12.1. The vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring login response times.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.