CVE-2026-54685 gtsteffaniak CVE debrief

Who should care

Users of FileBrowser Quantum, especially those with publicly accessible instances, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 1.3.2-beta or later, implementing additional monitoring for authentication attempts, and considering the use of a Web Application Firewall (WAF) to detect and prevent exploitation attempts.

Technical summary

The `/api/auth/login` endpoint in FileBrowser Quantum does not execute in constant time, allowing an attacker to exploit this by sending login requests with different usernames and measuring the response times to determine if a username is valid. This issue can be used to enumerate valid usernames. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The issue was patched in version 1.3.2-beta.

Defensive priority

Medium

Recommended defensive actions

• Update to version 1.3.2-beta or later
• Implement additional monitoring for authentication attempts
• Consider using a Web Application Firewall (WAF) to detect and prevent exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T15:16:43.787Z and last modified on 2026-07-21T16:17:15.607Z. The NVD entry is currently in the 'Received' state. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability affects FileBrowser Quantum, a free, self-hosted, web-based file manager. The `/api/auth/login` authentication endpoint is vulnerable to a timing attack. This issue was patched in version 1.3.2-beta.

Official resources