{"id":"CVE-2026-62860","title":"Picsou vulnerable to login timing attack","summary":"Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/Auth…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-208"],"vendor":"Zoeille","product":"picsou-finance","affected":["picsou-finance < 1.0.8"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T18:15:52.514765Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:18:00.135Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62860","references":[{"url":"https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6","label":"https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6"},{"url":"https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59","label":"https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59"},{"url":"https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8","label":"https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8"}],"tags":["cve.org","exploit-available"],"epss":0.00236,"epssPercentile":0.14707,"ingestedAt":"2026-11-05T16:24:31.465Z","slug":"CVE-2026-62860","body":"## Overview\n\nPicsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.\n\n## Affected\n\n- `picsou-finance < 1.0.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":235582,"id":"CVE-2026-62860","ts":1793991738688,"field":"exploit_available","old":"false","new":"true"}]}