CVE-2026-61503 | THREATINT

Description

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.

PUBLISHED Reserved 2026-07-10 | Published 2026-07-13 | Updated 2026-07-14 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

Observable Response Discrepancy

Product status

Default status

affected

3.0.0 (semver) before 3.2.1

affected

Credits

Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research finder

References

github.com/rejetto/hfs/releases/tag/v3.2.1 (hfs v3.2.1 Release Notes) release-notes patch

www.vulncheck.com/...meration-via-login-response-differences third-party-advisory

cve.org (CVE-2026-61503)

nvd.nist.gov (CVE-2026-61503)

Download JSON