Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-414184ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint

Medium 5.3

In plain English

A medium-severity security flaw in 4gaBoards from RARgames. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

Affected products (as reported)

Vendor	Product	Versions
RARgames	4gaBoards	< 3.3.5

Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/RARgames/4gaBoards/security/advisories/GHSA-8mj9-p99h-jhxp x_refsource_CONFIRM