CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- open-emr openemr OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading 5.3 Medium
- sysadminsmedia homebox HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay 3.7 Low
-
libcatalyst-plugin-authentication-perlDebian Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier 7.5 High - sgbett secp256k1-native secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication 5.9 Medium
- zoeille picsou-finance Picsou vulnerable to login timing attack 5.3 Medium
- watchguard fireware os Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets 8.7 High
- appsup-dart jose Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose 5.9 Medium
- qnap systems inc. qurouter Lack of Reproducible Vulnerability Evidence in QNAP Report 5.3 Medium
- cockpit-hq cockpit Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check 6.9 Medium
- red hat openstack platform 18.0 Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison 7.4 High
- gophish Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy 6.3 Medium
- legion of the bouncy castle inc. bc-java HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler 5.9 Medium
- legion of the bouncy castle inc. bc-java NTRU leaks private key information by reducing secret values with a non-constant-time integer division 8.2 High
- oauthlib OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison 6.8 Medium
- openssl Timing Side-Channel in SM2 Signature Generation 3.7 Low
- openssl Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V 3.7 Low
- openssl Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves 3.7 Low
- github enterprise server GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery 9.3 Critical
- openbao OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack 9.2 Critical
- hkuds lightrag LightRAG: Plaintext Passwords Compared Without Constant-Time Function 5.9 Medium
- traefik Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle 6.3 Medium
- dgtlmoon changedetection.io dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy 6.3 Medium
- devolutions server Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) 5.3 Medium
- steveiliop56 tinyauth Tinyauth: User enumeration attack by timing oracle 6.9 Medium
- nagios xi An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function... 3.5 Low
- drupal saml sso - service provider SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 4.8 Medium
- paytr payment and electronic money institution inc. virtual pos iframe api whmcs module Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module 7.5 High
- phpseclib phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery 6.3 Medium
- cockpit-hq cockpit Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing 6.9 Medium
- free5gc free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA 3.7 Low
- adobe dimension Dimension Blind SSRF via Database Test Connection Feature 5.1 Medium
- spring security, vmware spring security +1 more Timing Attack via Non-Constant-Time Comparison of Sensitive Values 5.9 Medium
- centarro commerce cybersource Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 3.7 Low
- getgrav grav Grav CMS before 2.0.16 Timing Attack via verifyNonce 6.3 Medium
- getgrav grav Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison 8.7 High
- wazuh Wazuh: Username Enumeration via Timing Side-Channel 5.3 Medium
-
libnet-oauth-perlDebian,perl-Net-OAuthMageia +1 more Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify 7.5 High -
ep_etherpad-litenpm Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling No score - ocaml mirage-crypto-ec An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing... 5.9 Medium
- oberon microsystems ag ocrypto Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto 5.9 Medium
- oberon microsystems ag psa crypto Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto 5.9 Medium
- amd vitis™ libraries - security module, vitis™ unified installer for fpgas & adaptive socs in windows +1 more Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow... 7.7 High
- trusted computing group tpm2.0 CVE-2026-6727 5.9 Medium
- weechat WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication 7.4 High
- apache apr-util, apache software foundation portable runtime utility +1 more Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack 7.5 High
- omicron electronics gmbh stationscout Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout 8.3 High
- omicron electronics gmbh stationguard Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard 8.1 High
- jenkins project webhook secret credentials provider plugin Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a... 3.7 Low
- pyca cryptography cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing 8.2 High
- papercut ng/mf PaperCut NG/MF: User enumeration via timing attack 6.9 Medium
- Show olderLoading…