Skip to content
OpenAdvisories

Weakness (CWE)

CWE-208: Observable Timing Discrepancy

Base Incomplete

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Source: MITRE CWE-208

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-8794 Public exploit

    PaperCut NG/MF: User enumeration via timing attack

    PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes …

    PaperCut PaperCut NG/MF
  • Medium 4.8
    CVE-2026-33006 Public exploit

    Apache HTTP Server: mod_auth_digest timing attack

    A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2026-26717 Public exploit

    OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function

    An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and…

    richie PyPI
  • Medium 5.4
    CVE-2024-54772 Public exploit

    An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stab…