Vulnerability · Published Aug 3, 2026 · Assigned by PaperCut
CVE-2026-8794PaperCut NG/MF: User enumeration via timing attack
Medium 6.9
In plain English
A medium-severity security flaw in PaperCut NG/MF from PaperCut. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PaperCut | PaperCut NG/MF | 0 – before 26.0.3 |
Weakness: CWE-208 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N