---
id: CVE-2026-62860
title: Picsou vulnerable to login timing attack
summary: >-
  Picsou is a self-hosted personal finance dashboard. In the affected login
  implementation, the `/api/auth/login` endpoint reveals whether a username
  exists through a timing discrepancy. In
  `backend/src/main/java/com/picsou/controller/Auth…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-208
vendor: Zoeille
product: picsou-finance
affected:
  - picsou-finance < 1.0.8
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T18:15:52.514765Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:18:00.135Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62860'
references:
  - url: >-
      https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6
    label: >-
      https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6
  - url: >-
      https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59
    label: >-
      https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59
  - url: 'https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8'
    label: 'https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8'
tags:
  - cve.org
  - exploit-available
epss: 0.00236
epssPercentile: 0.14707
ingestedAt: '2026-11-05T16:24:31.465Z'
---

## Overview

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.

## Affected

- `picsou-finance < 1.0.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.